4 ms·

Their announcement (see Reddit for example) says it was a “content deployment” issue which could suggest it’s the AV definitions/whatever rather than the driver

• dboreham 2y ago
  It's definitely the driver itself if it blue screens the kernel. Quite possibility data-sensitive of course.
  • rplnt 2y ago
    It might have been a long-present bug in the driver, yes, but today's failure was apparently caused by content/data update.
    • easytiger 2y ago
      In most appreciations of risk around upgrades in environments with which i am familiar, changing config/static data etc counts as a systemic update and is controlled in the same way
      • dalyons 2y ago
        You would lose a lot of the benefits of a system like crowdstrike if you waited to slowly roll out malware definitions and rules.
        • easytiger 2y ago
          Survived this long without such convenience. anything worth protecting lives behind a firewall anyway
  • baq 2y ago
    https://x.com/brody_n77/status/1814185935476863321 https://x.com/brody_n77/status/1814185935476863321 [0] The driver can't gracefully handle invalid content - so you're kinda both right. [0] brody_n77 is: Director of OverWatch, CrowdStrike Inc.
    • piyh 2y ago
      Looks like a great way to bypass crowd strike if I'm an adversary nation state
    • jrochkind1 2y ago
      I came to HN hoping to find more technical info on the issue, and with hundreds of comments yours is the first I found with something of interest, so thanks! Too bad there's no way to upvote it to the top.
    • everybodyknows 2y ago
      Anyone copy the original text? Now getting: > Hmm...this page doesn’t exist. Try searching for something else
      • baq 2y ago
        I don’t have the exact copy, but it said it was a ‘channel file’ which was broken.