4 ms·

Microsoft can't really "certify" their way out of this. Crowdstrike updates as they find threats; that is, all the time. Microsoft can't perfectly vet every u

Microsoft can't really "certify" their way out of this. Crowdstrike updates as they find threats; that is, all the time. Microsoft can't perfectly vet every update - they come too fast.

lambdaone 2y ago
That's all fine, until one day Crowdstrike is the threat.
- AnimalMuppet 2y ago
  Right. So the model is broken. You cannot both respond to threats in a timely manner and have Microsoft certify that the update is safe. That leaves you either not responding quickly or responding with uncertified updates. In the past, we have examples of not responding quickly that took down large chunks of the internet (I don't remember the examples, but they were quite famous at the time). Now we have an example of a fast, uncertified update taking down a large chunk of the internet. So, given that it can take down much of the internet no matter which we choose, now what do we do?
  - breadwinner 2y ago
    Crowdstrike didn't have the right processes in place. What can we do? Require them to have documented processes, and require periodic (like every 6 months) third-party auditing that they have the right processes, and they are complying with their own processes. More info: https://en.wikipedia.org/wiki/System_and_Organization_Controls https://en.wikipedia.org/wiki/System_and_Organization_Contro...
breadwinner 2y ago
So they need to certify that the third party has the right processes in place, as opposed to certifying the binary output. Look up SOC 2.
- isbvhodnvemrwvn 2y ago
  You can do checkbox exercises all day, won't make a difference. Nearly all banks have long long lists of certification, they still have extremely bad customer-side security processes because you can "interpret" various guidanecs and pay the right auditors enough to have it ignored.
ahepp 2y ago
That sounds like an argument towards Microsoft not allowing third party drivers like this, or at least strongly discouraging them and making it clear that it breaks the warranty. Didn't Apple do this with deprecating kexts? (maybe that's not applicable, I don't do a lot of macOS dev) Auditing every data file update seems just as error/system failure prone as Crowdstrike's process was. I don't see a clear reason why Microsoft would have any better incentive than Crowdstrike here. I do think that maybe the commercial OS vendor has _some_ support responsibilities to at least warn and discourage customers from using the product in dangerous ways? I mean, it's not like we're talking about a couple people installing bad kernel drivers here, we're talking about a worldwide incident. WHQL seems like an admission that Microsoft knows they need to keep dangerous drivers out of the ecosystem.
- deepsummer 2y ago
  Let's say MS does not allow third party drivers at all. Then they would have a monopoly over software drivers and system software like security systems. I doubt regulators would want that.

Microsoft can't really "certify" their way out of this. Crowdstrike updates as they find threats; that is, all the time. Microsoft can't perfectly vet every update - they come too fast.

lambdaone 2y ago

That's all fine, until one day Crowdstrike is the threat.

AnimalMuppet 2y ago
Right. So the model is broken. You cannot both respond to threats in a timely manner and have Microsoft certify that the update is safe. That leaves you either not responding quickly or responding with uncertified updates. In the past, we have examples of not responding quickly that took down large chunks of the internet (I don't remember the examples, but they were quite famous at the time). Now we have an example of a fast, uncertified update taking down a large chunk of the internet. So, given that it can take down much of the internet no matter which we choose, now what do we do?
- breadwinner 2y ago
  Crowdstrike didn't have the right processes in place. What can we do? Require them to have documented processes, and require periodic (like every 6 months) third-party auditing that they have the right processes, and they are complying with their own processes. More info: https://en.wikipedia.org/wiki/System_and_Organization_Controls https://en.wikipedia.org/wiki/System_and_Organization_Contro...

breadwinner 2y ago

So they need to certify that the third party has the right processes in place, as opposed to certifying the binary output. Look up SOC 2.

isbvhodnvemrwvn 2y ago
You can do checkbox exercises all day, won't make a difference. Nearly all banks have long long lists of certification, they still have extremely bad customer-side security processes because you can "interpret" various guidanecs and pay the right auditors enough to have it ignored.

ahepp 2y ago

That sounds like an argument towards Microsoft not allowing third party drivers like this, or at least strongly discouraging them and making it clear that it breaks the warranty. Didn't Apple do this with deprecating kexts? (maybe that's not applicable, I don't do a lot of macOS dev) Auditing every data file update seems just as error/system failure prone as Crowdstrike's process was. I don't see a clear reason why Microsoft would have any better incentive than Crowdstrike here. I do think that maybe the commercial OS vendor has _some_ support responsibilities to at least warn and discourage customers from using the product in dangerous ways? I mean, it's not like we're talking about a couple people installing bad kernel drivers here, we're talking about a worldwide incident. WHQL seems like an admission that Microsoft knows they need to keep dangerous drivers out of the ecosystem.

deepsummer 2y ago
Let's say MS does not allow third party drivers at all. Then they would have a monopoly over software drivers and system software like security systems. I doubt regulators would want that.