I’m seeing some real time, grade-A consent manufacturing regarding this massive crowdstrike outage. Every article I see blames Microsoft. I have no love for Microsoft, but they were not to blame. The people who are too blame are crowdstrike, the software company who deployed the broken update that caused the outage.

* Puts on immaculately thought out tinfoil hat *

Crowdstrike is more a piece of US surveillance tech than it is an actual security suite. In essence it can take any data from a device it is installed on and can execute any command on those devices (due to the way the software very tightly integrated with the windows operating system, bypassing security on the OS). A powerful tool when you consider that the US government can subpoena any us corporation to hand over the information they hold.

Now, crowdstrike had a huge market share, but you can bet that after this event people are going to be less willing to use it, and this will result in the US losing a huge part of its surveillance network. People don’t care what security suite they use, so long as it works, so people are going to switch.

Cue the absolute deluge of articles I’ve been seeing blaming this on Microsoft. An operating system so ingrained into the business world that no-one is going to switch to an alternative, no matter how much they fuck up. They can take the heat and mitigate the damage to crowdstrike. Thus preserving the US state surveillance appetatus.

* Tin foil hat removed and placed back into its extremely well thought out box *

What do people think?

  • CarbonScored [any]@hexbear.net
    link
    fedilink
    English
    arrow-up
    6
    ·
    edit-2
    2 months ago

    Yes? Of course crashes still occur in Linux. That bug is not a driver issue, but a kernel instruction issue.

    It should also be noted that although that bug was solely seen with Crowdstrike, the actual panic was recognised as a bug and fixed on the kernel side. So the Linux project took responsibility and fixed their side. Most notably, the issue you linked wasn’t actually caused by previous negligence.

      • CarbonScored [any]@hexbear.net
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        2 months ago

        As I mentioned, that isn’t an issue with driver verification. In fact, the bug only seems to apply in user mode, rather than kernel mode.

        • git [he/him, comrade/them]@hexbear.net
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          In fact, the bug only seems to apply in user mode, rather than kernel mode.

          Yes that’s the point. User mode required it to go through eBPF which does verification, which had a bug that caused panics. It could have been any program, it being crowdstrike was incidental. My point is that “this wouldn’t have happened on Linux because reasons” isn’t necessarily true.