5 ms·

I don’t see how this is Microsoft’s fault or issue. MS can’t prevent a software vendor from breaking the machine.

by johnnyo 2y ago

williamstein 2y ago
Apple
- duxup 2y ago
  Does Apple have a better method for preventing something like that? I love my Mac, but I've had crashes that I suspect were caused by an application.
  - rawgabbit 2y ago
    https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/1/web/1#sec41bf3cd61 https://support.apple.com/guide/security/operating-system-in...
    - duxup 2y ago
      TY
  - jnwatson 2y ago
    They have sunset third party kext files. That means if the kern crashes, it is Apple's fault. I once did a little MacOS driver development and had a kext signing key. It was an unforgiving, poorly-documented environment. Good riddance.
  - deleted 2y ago
    [deleted]
- conscion 2y ago
  Large corporations buy Windows _because_ they can have this level of control over their machines. The CTOs and auditors want to be able to say they've personally secured their systems using "top of the line" security software.
MattGaiser 2y ago
They could basically eliminate vendors and make everyone use a Microsoft tool. But I suspect many would object to that solution also.
- diego_sandoval 2y ago
  The they'd get sued by the EU for bundling these tools into the OS and eliminating the market for third party vendors.
  - MattGaiser 2y ago
    Exactly. If you are going to demand a ton of different companies build different parts of a product, integration issues are unavoidable.
drpossum 2y ago
I'm going to follow the guidelines and not be snarky: Microsoft is not some weak company at the mercy of the market. They choose their vendors (they also actively throw their weight around with vendors) and MS on top of that is capable of doing anything in-house (or buying it to bring it in house). The stance of "let's not hold companies accountable for cutting corners" is one reason everything is getting worse. It's because we collectively let it get worse.
- johnnyo 2y ago
  I’m not following your line of reasoning, can you clarify? Is the argument that it was MS responsibility to bake something like this in at the OS level? And if they did it would be more robust? I’m not sure I agree. MS has already gotten in trouble for monopolistic practices before, so from a legal standpoint, I’m not sure that’s the best course of action.
- MattGaiser 2y ago
  Except that doing those things could be viewed as monopolistic or anti-competitive behaviour. If Microsoft is responsible, then they need to also need greater control. If Microsoft isn't supposed to have that kind of power, they cannot be blamed.
- alwa 2y ago
  Is it possible that you’re talking about a different incident? In the incident at hand, didn’t enterprises in question choose the EDR vendor, not Microsoft? Is the implication that Microsoft should be compelled to develop its own EDR product at a level of sophistication comparable to what CrowdStrike offered, and compete with them on that basis? It feels strange to me to hold Microsoft accountable for the poor design decisions of firms who just develop third-party software on their platform.
- georgeplusplus 2y ago
  >>>It's because we collectively let it get worse What would you suggest we do to make sure it doesn't get worse? A large majority of the population probably has no idea the implications of this outage and what to do about it because most are tech deaf.
jgeada 2y ago
WTF? Isn't that exactly the one of the main jobs of the OS, to not crash regardless of what user-space software is doing?
- johnnyo 2y ago
  I think the idea is that CrowdStrike doesn’t run in user space. If an Nvidia driver had bricked the machines, would that be MS fault or Nvidia fault?
  - diffeomorphism 2y ago
    Why not both? I am perfectly happy to blame multiple parties, not just one.
  - flohofwoe 2y ago
    IME a graphics driver crash recovers just fine on Windows. The screen goes black for half a second and you're back in business without losing progress.
    - velcrovan 2y ago
      I've had NVidia drivers bluescreen Windows 10 and 11 machines within the past six months.
- zdragnar 2y ago
  Endpoint protection is hardly user-space software. It gets deeply privileged access to the entire system.
- fifteen1506 2y ago
  it was a kernel mode driver.
- theblazehen 2y ago
  It wasn't user space, it installs a kernel mode driver
- 2y ago
dzonga 2y ago
because the underlying os they provide allows kernel access. if they had windows fence of the kernel and maybe provide a security api ? then this whole thing wouldn't be an issue
- deleted 2y ago
  [deleted]
traveler1 2y ago
Drivers have the right to crash the system in my books - software doesn't. They need to take a stronger stance on antiviruses and kernel based software in general and push defender as the defacto antivirus for Windows.

I don’t see how this is Microsoft’s fault or issue. MS can’t prevent a software vendor from breaking the machine.

williamstein 2y ago

Apple

duxup 2y ago
Does Apple have a better method for preventing something like that? I love my Mac, but I've had crashes that I suspect were caused by an application.
- rawgabbit 2y ago
  https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/1/web/1#sec41bf3cd61 https://support.apple.com/guide/security/operating-system-in...
  - duxup 2y ago
    TY
- jnwatson 2y ago
  They have sunset third party kext files. That means if the kern crashes, it is Apple's fault. I once did a little MacOS driver development and had a kext signing key. It was an unforgiving, poorly-documented environment. Good riddance.
- deleted 2y ago
  [deleted]
conscion 2y ago
Large corporations buy Windows _because_ they can have this level of control over their machines. The CTOs and auditors want to be able to say they've personally secured their systems using "top of the line" security software.

MattGaiser 2y ago

They could basically eliminate vendors and make everyone use a Microsoft tool. But I suspect many would object to that solution also.

diego_sandoval 2y ago
The they'd get sued by the EU for bundling these tools into the OS and eliminating the market for third party vendors.
- MattGaiser 2y ago
  Exactly. If you are going to demand a ton of different companies build different parts of a product, integration issues are unavoidable.

drpossum 2y ago

I'm going to follow the guidelines and not be snarky: Microsoft is not some weak company at the mercy of the market. They choose their vendors (they also actively throw their weight around with vendors) and MS on top of that is capable of doing anything in-house (or buying it to bring it in house). The stance of "let's not hold companies accountable for cutting corners" is one reason everything is getting worse. It's because we collectively let it get worse.

johnnyo 2y ago
I’m not following your line of reasoning, can you clarify? Is the argument that it was MS responsibility to bake something like this in at the OS level? And if they did it would be more robust? I’m not sure I agree. MS has already gotten in trouble for monopolistic practices before, so from a legal standpoint, I’m not sure that’s the best course of action.
MattGaiser 2y ago
Except that doing those things could be viewed as monopolistic or anti-competitive behaviour. If Microsoft is responsible, then they need to also need greater control. If Microsoft isn't supposed to have that kind of power, they cannot be blamed.
alwa 2y ago
Is it possible that you’re talking about a different incident? In the incident at hand, didn’t enterprises in question choose the EDR vendor, not Microsoft? Is the implication that Microsoft should be compelled to develop its own EDR product at a level of sophistication comparable to what CrowdStrike offered, and compete with them on that basis? It feels strange to me to hold Microsoft accountable for the poor design decisions of firms who just develop third-party software on their platform.
georgeplusplus 2y ago
>>>It's because we collectively let it get worse What would you suggest we do to make sure it doesn't get worse? A large majority of the population probably has no idea the implications of this outage and what to do about it because most are tech deaf.

jgeada 2y ago

WTF? Isn't that exactly the one of the main jobs of the OS, to not crash regardless of what user-space software is doing?

johnnyo 2y ago
I think the idea is that CrowdStrike doesn’t run in user space. If an Nvidia driver had bricked the machines, would that be MS fault or Nvidia fault?
- diffeomorphism 2y ago
  Why not both? I am perfectly happy to blame multiple parties, not just one.
- flohofwoe 2y ago
  IME a graphics driver crash recovers just fine on Windows. The screen goes black for half a second and you're back in business without losing progress.
  - velcrovan 2y ago
    I've had NVidia drivers bluescreen Windows 10 and 11 machines within the past six months.
zdragnar 2y ago
Endpoint protection is hardly user-space software. It gets deeply privileged access to the entire system.
fifteen1506 2y ago
it was a kernel mode driver.
theblazehen 2y ago
It wasn't user space, it installs a kernel mode driver
2y ago

dzonga 2y ago

because the underlying os they provide allows kernel access. if they had windows fence of the kernel and maybe provide a security api ? then this whole thing wouldn't be an issue

deleted 2y ago
[deleted]

traveler1 2y ago

Drivers have the right to crash the system in my books - software doesn't. They need to take a stronger stance on antiviruses and kernel based software in general and push defender as the defacto antivirus for Windows.