You are viewing a single thread.
View all comments
99 points

Oh FFS. I love this era where companies will not accept the blame due to “liability”, even when they are explicitly to blame.

permalink
report
reply
34 points

Fuck Microsoft and fuck Windows.

But if you inject hacky bullshit third party code into someone’s OS that breaks things, it’s not the OS’s fault.

permalink
report
parent
reply
5 points

But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn’t have certified it because they can not fully test it. If they didn’t know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn’t certify it, they would have had zero fault.

permalink
report
parent
reply
10 points

Certifying a driver is not an endorsement.

It is a verification that it is legitimately from who it claims to be from. Microsoft has zero fault, period.

permalink
report
parent
reply
74 points
*

We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer. Because anything else means Microsoft is in control and not the software you installed.

It’s no different than Linux in that way. If you install a buggy device driver on Linux, that’s your/the driver’s fault, not Linux.

permalink
report
parent
reply
4 points

But what if Windows have something similar to eBPF in Linux, and CS opted to use it, will this disaster won’t happen at all or in a much smaller scale and less impactful?

permalink
report
parent
reply
5 points

Crowdstrike managed to fuck up Linux through eBPF just as well.

https://access.redhat.com/solutions/7068083

If you load hacky shit into the kernel it can always find a way to make a nasty surprise. eBPF is a little bit better fence, not some miracle that automatically fixes shitty code.

permalink
report
parent
reply
-10 points

Yeah I saw the article that says they’re legally required but until I can actually read that document where it says “thou shall give everyone ring-0” access I’m gonna call it bullshit.

permalink
report
parent
reply
11 points

If it’s not ring 0, it’s not full access. They are legally required to give full access.

permalink
report
parent
reply
-8 points

We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

Sorry, how is that related to the stability of the kernel?

permalink
report
parent
reply
14 points

I explained in my second sentence.

“They are legally required to give Crowdstrike or anyone low level access to the OS.”

If you install a buggy driver into Linux and it crashes, that’s not a problem with the Linux kernel.
https://www.redhat.com/sysadmin/linux-kernel-panic

permalink
report
parent
reply
-8 points
*

They are legally required to let Crowdstrike crash your computer.

I call Bullshit.

If it had been Windows NT 3.5, there would have been no bluescreens around the world. It would have stopped the buggy software, given a message accordingly, and continued it’s job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.

Now you tell me that Windows NT 3.5 is illegal?

permalink
report
parent
reply
10 points

I ran 3.5. Yes, a network driver crash would blue screen NT3.5. Graphics were in user space in 3.5 so a video driver couldn’t take NT 3.5 down but networking was in the kernel. https://en.m.wikipedia.org/wiki/Hybrid_kernel

permalink
report
parent
reply
18 points

You could absolutely install software on Windows 3.5 that would crash the system.

permalink
report
parent
reply
-1 points
*

The thing is, Microsoft’s virus-scanning API shouldn’t be able to BSOD anything, no matter what third-party software makes calls to it, or the nature of those calls. They should have implemented some kind of error handler for when the calls are malformed.

So this is really a case of both Crowdstrike and Microsoft fucking up. Crowdstrike shoulders most of the blame, of course, but Microsoft really needs to harden their API to appropriately catch errors, or this will happen again.

I’m an idiot. For some reason, I was thinking about the Windows Defender API, which can be called from third-party applications.

permalink
report
parent
reply
1 point

Isn’t that API what the article is talking about?

permalink
report
parent
reply
11 points

I don’t believe there was any specific API in use here, for virus scanning or not. I suppose maybe the device driver API? I am not a kernel developer so I don’t know if that’s the right term for it.

Crowdstrike’s driver was loaded at boot and caused a null pointer dereference error, inside the kernel. In userspace, when this happens, the kernel is there to catch it so only the application that caused it crashes. In kernelspace, you get a BSOD because there’s really nothing else to do.

https://youtube.com/watch?v=wAzEJxOo1ts

permalink
report
parent
reply
-13 points

I actually agree, I own my computer / OS and I should be able to do what you’re saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.

permalink
report
parent
reply
15 points

You are going to give grief to Microsoft for allowing what you want?

???

permalink
report
parent
reply
11 points

That doesn’t make any sense. How does arguing against your position do anything but harm it?

Maybe just give them grief over the myriad negative things they do that don’t counter your position?

permalink
report
parent
reply
56 points
*

You are not wrong, but people don’t want to hear it. Do we want to retain control over what goes into kernel space or not? If so, we have to accept that whatever we stuff in there can crash the entire thing. That’s why we have stuff like driver signatures. Which Crowdstrike apparently bypassed with a technical loophole from how I understand it.

permalink
report
parent
reply

Technology

!technology@lemmy.world

Create post

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


Community stats

  • 15K

    Monthly active users

  • 6.7K

    Posts

  • 153K

    Comments