6 ms·
I guess we can call it a "black Thursday" for microsoft.
by vb-8448 2y ago
I guess we can call it a "black Thursday" for microsoft.
- bluedino 2y agoWhy is MS getting any blame for the Crowdstrike thing?
- yelnatz 2y agoThey allow a 3rd party to change Kernel stuff with an update. Apple banned this a while ago.
- tambourine_man 2y ago*banned Made it a lot harder for everyone involved, but still possible, as it’s a very useful technique. PS: Since I'm being downvoted, here is the link showing that it is still possible using Reduced Security: https://support.apple.com/en-gb/guide/mac-help/mchl768f7291/mac https://support.apple.com/en-gb/guide/mac-help/mchl768f7291/... I doubt Apple will completely disable kext in the near future. Making it hard enough to be impractical has most of the benefits already.
- kykqx 2y agoIt is supposed to be like that. Antivirus software always works as a driver in the kernel, no other way. You'll get the same in Linux, for example. In MacOS it may be slightly better (if I remember right Darwin is a micro-kernel), but in fact a broken driver still can crash the system there.
- philistine 2y ago> Antivirus software always works as a driver in the kernel, no other way. You're confidently wrong: https://developer.apple.com/support/kernel-extensions/ https://developer.apple.com/support/kernel-extensions/
- kykqx 2y agoThis page is only about using some APIs, that are now supposed to be called through wrappers. I would say it significantly limits the developers, and also may introduce additional flaws.
- philistine 2y agoYet it is how antivirus works on Mac now.
- AmVess 2y agoLetting an app take down your OS, perhaps.
- DebtDeflation 2y agoNot just take down the OS, but render the machine completely unbootable until a config file gets manually removed from the HD by starting in Safe Mode from the console.
- TillE 2y agoIt's not an "app", it's a kernel driver. A serious driver bug is catastrophic in nearly any OS.
- darby_nine 2y agoPutting aside the semantic swamp of figuring out what an app actually refers to, this seems to be exactly the problem. They should have their signing keys revoked.
- vb-8448 2y agoWell, if you look on all news sites, they put highlight that is a windows issue. I personally think that IT managers should be blamed for the disaster, but in the collective imagination this will e a microsoft/windows problem.
- mingus88 2y agoBlaming IT managers is akin to blaming a bus driver when the bridge collapses. IT managers are required to implement AV for compliance. They'd lose their jobs if they refused to do it and either failed an audit or got hit by common malware. It's ironic to see so much praise this morning for the macOS model for kernel extensions. The fact of the matter is Microsoft allows 3rd party code to do exactly what happened today, and the industry leader in endpoint security completely failed to QA their updates.
- vb-8448 2y agoIT managers allowed an external entity to do a massive update on all their devices and servers. I'm not saying to don't install AV or not update it, just first update system-test envs and then roll out patches gradually, not all together.
- mingus88 2y agoBus drivers allowed themselves to be assigned routes over bridges that were not engineered or built well enough. It's ridiculous to put the blame on IT managers for this. The fact that Microsoft Azure itself has been affected by this shows that this is not a problem that any middle manager at a small firm should have be held responsible for.
- vb-8448 2y agoAre you serious? If I push a code change in production before going through the test environment and this cause trouble, I'll be fired. We already have rules and procedures that work for "normal" software, why they cannot be applied to AV software?
- bguebert 2y agoSeems like microsoft is getting put into the headlines because the Crowdstrike versions for mac and linux aren't affected. Plus Crowdstrike has a history of pushing people onto microsoft tech support when their software causes problems.
- phatfish 2y agoMicrosoft should have a certification program for software that messes around with kernel modules that could cause a BSOD. I guess they already do this for hardware drivers. Once software is effecting a certain number of endpoints the vendor has to prove they are testing sufficiently.
- ensignavenger 2y agoI would strongly oppose such restrictions. Of course I use Linux so I can install whatever kernel.modules I want to and no one can stop me :)
- philistine 2y agoHot take, but I think you should build from source to be able to modify the kernel. Kernel extensions don't have their place in our modern world.
- whamlastxmas 2y agoHN user in other thread claimed same issue happened last week with either Mac or gnu/Linux, I don’t recall which
- ensignavenger 2y agoCrowdstrike has caused kernel panics on Linux systems in the past too. I push FOSS hard and will hold that this is an example where using FOSS for all critical business software would have saved companies, but I don't particularly blame Microsoft directly for this outage. Incompetent IT managers buying software from their golf buddies is the real heart of the issue.
- skywhopper 2y agoBecause their OS allowed a third-party tool to crash it, worldwide, with no automated way of recovery?
- deleted 2y ago[deleted]
- bongodongobob 2y ago[dead]