3 ms·

That's not really the problem here. The problem is allowing a single vendor, with a reputation of fucking up over and over again, to push code into your produc

That's not really the problem here. The problem is allowing a single vendor, with a reputation of fucking up over and over again, to push code into your production systems at will with no testing on your part.

AndriyKunitsyn 2y ago
Right. I thought the "big guys" know better and they have some processes to vet Crowdstrike updates. Maybe even if they don't get its source code, they at least have a separate server that manages the updates, like Microsoft's WSUS. But no, they are okay with a black box that calls home and they give it kernel access to their machines. What?
- teeheelol 2y ago
  We do that. CS literally entirely pushed this over our staging system and straight into production.
  - grishka 2y ago
    Why did they have the technical means to do so?
    - teeheelol 2y ago
      Because our security guys are fuckwits. (I am operations management and fought against this product and approach for months)