3 ms·

From the parent comment: > it’s insane to me that this size and criticality of a company doesn’t have a staging or even a development test server that tests al

From the parent comment: > it’s insane to me that this size and criticality of a company doesn’t have a staging or even a development test server that tests all of the possible target images that they claim to support I know nothing about Crowdstrike, but I can guarantee that "they need to test target images that they claim to support" isn't what went wrong here. The implication that they don't test against Windows is so incredulous, it's hard to take the poster of that comment seriously.

StressedDev 2y ago
Thank you for pointing this out. Whenever I read articles about security, or reliability failures, it seems like the majority of the commenters assume that the person or organization which made the mistake is a bunch of bozos. The fact is mistakes happen (even huge ones), and the best thing to do is learn from the mistakes. The other thing people seem to forget is they are probably doing a lot of the same things which got CrowdStrike into trouble. If I had to guess, one problem may be that CrowdStrike's Windows code did not validate the data it received from the update process. Unfortunately, this is very common. The lesson is to validate any data received from the network, from an update process, received as user input, etc. If the data is not valid, reject it. Note I bet at least 50% of the software engineers commenting in this thread do not regularly validate untrusted data.
- maxquesar 2y ago
  Not validating an update signature is a huge security compliance issue. When you get certified, and I assume CroudStrike had many certifications, you provide proof of your compliance to many scenarios. Proving your updates are signed and verified is absolutely one of those.
- chrisjj 2y ago
  I'll bet 50% aren't delivering code that can stiff millions of PCs. And given Crowdstrike are, and data validation neglect is so common, why have they not already learned this lesson?

StressedDev 2y ago

Thank you for pointing this out. Whenever I read articles about security, or reliability failures, it seems like the majority of the commenters assume that the person or organization which made the mistake is a bunch of bozos. The fact is mistakes happen (even huge ones), and the best thing to do is learn from the mistakes. The other thing people seem to forget is they are probably doing a lot of the same things which got CrowdStrike into trouble. If I had to guess, one problem may be that CrowdStrike's Windows code did not validate the data it received from the update process. Unfortunately, this is very common. The lesson is to validate any data received from the network, from an update process, received as user input, etc. If the data is not valid, reject it. Note I bet at least 50% of the software engineers commenting in this thread do not regularly validate untrusted data.

maxquesar 2y ago
Not validating an update signature is a huge security compliance issue. When you get certified, and I assume CroudStrike had many certifications, you provide proof of your compliance to many scenarios. Proving your updates are signed and verified is absolutely one of those.
chrisjj 2y ago
I'll bet 50% aren't delivering code that can stiff millions of PCs. And given Crowdstrike are, and data validation neglect is so common, why have they not already learned this lesson?