3 ms·
On top of that, I am still struggling to understand how the people in charge of running orgs that run highly critical systems were OK with the idea that a 3rd p
by mr90210 2y ago
On top of that, I am still struggling to understand how the people in charge of running orgs that run highly critical systems were OK with the idea that a 3rd party software provider could push at anytime patches to the software they provide.
Sorry for being harsh with my following statement, but I believe that the companies affected by Crowdstrike share some responsibility on what happened yesterday.
- chrisjj 2y agoThe are OK with "push at anytime patches to the software" because that's a big part of what they are paying for. Rapid response to threats.
- pixl97 2y ago>Ping reply from 127.0.0.1 The threat is inside the building!
- lambdaone 2y agoYou're making the mistake of assuming that the people running those companies care about anything other than their job security, and buying in solutions is the best way to have a ready-made scapegoat when things go wrong. The mantra "no-one ever got sacked for buying IBM" still holds, you can just substitute "Oracle", or "Microsoft", or now - apparently - "Crowdstrike".
- meiraleal 2y agoThey share the whole of the responsibility of it. "my antivirus was updating" is not an acceptable excuse for a service to be down.
- notabee 2y agoIt's not harsh. The tide went out and it turns out a lot of people were swimming naked.
- ck45 2y agoI think I agree with you. On the other hand, I can also imagine that if autoupdates weren't the case, then 90% of installations would be a terribly outdated and probably vulnerable version. It's hard to imagine a common sense middle ground.
- cynicalsecurity 2y agoSurprisingly, the mantra "if it works, don't touch it" doesn't really work so great.
- cdchn 2y agoOne could make the argument that automatically patched software is, in aggregate, more secure/less problematic than chronically under-patched software that requires manual, human attention.
- AlbertCory 2y agoOne could, but in the old days when vulnerabilities happened, they didn't hit everyone at once. And if it hit your system, the vendor's first response would be "are you on the latest update? that's been fixed." (Unless the latest update IS the problem. In that case, being lazy was a good defense.)
- RedShift1 2y agoAs I understand it, customers do have control, but in this instance CrowdStrike overrode the settings of the customers.
- slt2021 2y ago- pushing patches is objectively a good idea, rapid response to threats and all. - Whats bad is instant global 0->1 rollout, instead of more gradual, blue/green/canary however you call it. With gradual rollout policy this whole thing could have been caught at their first couple guinea pig customers, and not the whole world
- patrick451 2y agoYou don't understand the word objective. It is beyond arrogant to think that controlling when a customer's day gets ruined is your prerogative. Let them make that decision.
- dehrmann 2y agoThey chose a major vendor and it checks off a compliance requirement.