What We Can LEARN About the CrowdStrike Outage

The global outage caused by CrowdStrike is major wakeup call. We can and should learn from the issue, and today I share my thoughts.
#crowdstrike #windows #software

00:00 - What Happened?
05:30 - Similarities to CrowdStrike and Manifest V3
08:55 - Too Much Reliance on Third Parties
10:05 - Too Much Trust in Automatic Updates
12:55 - Too Much Trust in Third Parties

-----------
Support Switched to Linux!
-----------
Social Media:
🐦 Twitter: @switchedtolinux
🐸 Gab: @switchedtolinux
💡 Minds: @switchedtolinux
Reddit: /r/switchedtolinux
-----------

[prorityfeed]

Lots of people were yelling about crowdstrike 5 years ago. No one listened. I've been telling everyone I can about the dangers of over reliance on proprietary centralized systems longer than that. No one listens. And that's fine. Everyone is free to make their own decisions, including bad ones. Wheat and chaff and all that.

[janice-ldpf]

Another real-world example, in a long line of examples, of why monopolies...I mean "centralization" is dangerous. And yet, nothing will change.

[PhinAI]

Isn't it funny how these companies end up living up to its name?

[HackManJay]

"unified security system" proceeds to destroy a boat load of computers around the world because of lack of proper testing.

[terrydaktyllus]

"What We Can LEARN About the CrowdStrike Outage?"

"That anyone still using Windows is a complete fecking eejit."

[paulov]

Hang on, so this happened before by the same company a few years ago?
And everyone still uses these clowns?

[fabricio]

What we learn about this Outtage, is that we were right all the time about use Linux-base Operational Systems, Microsoft shows how fragile, obsolete and vulnerablie that old OS, and we shows that Closed Source Software are a

[asdion]

"what can we learn"
DON'T BLOODY UPDATE DIRECTLY TO PRODUCTION.

[shawngrinter]

And the fact CloudStrike moved its development to India in February 2024 I’m sure is in no way related to a bad code drop in July.


Right

[donjaksa]

We were talking about this in the bar last night...

The objective of NIST Special Publication 800-53 is to provide a set of security controls that can satisfy the breadth and depth of security requirements levied on organizations, mission/business processes, and information systems and that is consistent with and complementary to other established information security standards

Organizations have the responsibility to select the appropriate security controls, to implement the controls correctly, and to demonstrate the effectiveness of the controls in satisfying established security requirements

The security controls facilitate the development of assessment methods and procedures that can be used to demonstrate control effectiveness in a consistent/repeatable manner—thus contributing to the organization’s confidence that security requirements continue to be satisfied on an ongoing basis

Use security controls to protect the confidentiality, integrity, and availability of information that is processed, stored or transmitted

security controls satisfy security requirements

...just my opinion

[grokitall]

you don't have to trust anyone. that is the starting assumption for resilience planning. things break, ask what happens next and how do you cope.

[minion]

That graphic at 9.07 hilarious and hope things like planes and big ships don't use crowdsrike/windows of the comments here are gold.

[Johnny-esxg]

I agree with you point on automatic updates. The IT department of a company should be able to vet updates before it's deployed. If that was the case this disaster would not have happened. Any mistake of God forbid, security breach of a software vendor can cause massive damage

[DavidJacka-icrd]

You can stop the automatic install of OS updates in the developer settings of stock Android on pixel in developer settings. I don't use Graphine anymore but it's worth a look to see if it has an option as well

[rickforges]

Dave's garage has a good rundown on the Crowdstrike issue. is a retired Win 95 developer. he explains code is basically y run in kernel mode without being tested as Win normally does. Linux has ClamAV ; does it run in kernel mode or user mode ? btw nice coverage Tom on this issue..

[jamespong]

Apple doesn't allow kernel drivers by other people

[alekjwrgnwekfgn]

Off topic: its good to see NVIDIA drivers open sourced. What can we expect? Who would be working on that?

[grokitall]

any driver can kill any kernel.

the problem is that the kernel does not detect it and block it next reboot.

then the solution is to just power cycle the machine.

[Nofanboyz]

Not sure which distro(s), but one or more of my Linux systems allowed for security updates only.

[gilbertnf]

The issue is: don't push nothing directly to production. Test if first!
And beside that, many modern Linux Distribution comes with automatic updates enable and, worst, required a reboot.
Let me chosse whatever I want update or not ok?
Thanks.