7 ms·
Microsoft's global sprawl under fire from regulators after Windows outage
- lambdaone 2y agoIt was inevitable that something like this would happen sooner or later, either through security complacency or sheer bad luck. We were just fortunate it only happened to Windows.
- pjmlp 2y agoThey already managed to bork Linux systems a couple of months ago, but then again all the services that went down, never heard of Year of Linux Desktop. https://x.com/shantanugoel/status/1814567750289006686 https://x.com/shantanugoel/status/1814567750289006686
- bilekas 2y agoI'm of two minds on this one personally. I see simular `single points of failure` potentials with CloudFlare for example. Sometimes it highlights this topic. But at the same time, I really do feel more comfortable with a large experienced company being responsible for some of that infrastructure that is expensive to maintain correctly.. I don't know what the solution is, but it's something that needs to be figured out.
- bsder 2y ago> I don't know what the solution is, but it's something that needs to be figured out. The "solution" is that you bust up large companies until their market share of a vertical is less than 20%. The fact that Microsoft controls 75%+ of the desktop/laptop market should get that pulled out of the company and broken up. The fact that Google and Microsoft control the email hosting market should get pulled out and broken up, etc.
- jmclnx 2y ago>In a blog post Saturday, Microsoft estimated that the update affected 8.5 million devices, which amounts to less than 1 percent of computers running Windows Cute, but the 1% were the systems that matter most, who cares if people could still watch LOL Cat Videos at home. No one I know who works at a company using a Windows system was unaffected. Actually wrong, 1 person was fine, he got a brand new PC the day before, but it had no corporate mandated "security items" (per the help desk), so he could work. He was still able to connect to the corporate intranet.
- tomrod 2y agoThat's probably a very low estimate. Many hospitals and government agencies were virtually crippled.
- ApolloFortyNine 2y agoDo some of these news agencies own Crowdstrike stock? How can you blame Windows here? For simply allowing an application that can crash the OS? I truly don't understand the angle here, besides ignorance.
- dlahoda 2y agonot only allowing, but approving? they signed driver, right? linux also allows, by approval is decentralized
- bilekas 2y agoBased on a simular comment you've made, I think there is some confusion for you as to what driver signing actually is. It's a certificate of Authority to identify the Distributer of the driver as legitimate or not. Indeed, this messup was signed, so correctly it was signed. As for the code/behaviour. It's nothing to do with signing.
- gruez 2y ago>by approval is decentralized Translation: it's up to whoever is the sysadmin is, which probably was responsible for crowdstrike being installed in the first place. Such "approval" would have made no difference in preventing this disaster.
- gruez 2y agoIt seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?
- dlahoda 2y agois not it the case that kernel drivers are signed and approved by microsoft?
- bilekas 2y agoI'm not aware of Microsoft signing off on vendor kernal drivers code changes. Driver signing is not a Quality Assurance measure. It's an identify measure.
- AstralStorm 2y agoMore importantly, the code signing is a security measure. You can in theory vet the signature database by hand preventing the execution of unapproved drivers. Microsoft normally puts it in revocation mode only, with bad drivers with unfixed holes being blocked.
- gruez 2y agoWould the disaster have been prevented if there was no code signing? Or are you arguing that Microsoft should scrutinize code even harder?
- jenscow 2y agoMany in this industry have been saying this for a while now. "I think that I am familiar with the fact that you are going to ignore this particular problem until it swims up and bites you on the ass."
- AlexDragusin 2y ago> airlines in India handed out handwritten plane tickets https://x.com/akothari/status/1814202068531552666 https://x.com/akothari/status/1814202068531552666
- xnx 2y agoDid Crowdstrike PR write this?
- russellbeattie 2y agoMicrosoft's culpability lies in the fact that their OS is still ridiculously brittle. How it can't seem to manage to be able to automatically roll back changes from something as serious as a kernel change is ludicrous. It's CrowdStrike's fault that the kernel was faulty. It's Microsoft's fault that it caused a never ending bootloop that needed manual intervention to fix.
- jborean93 2y agoThe update wasn’t actually a kernel driver but a configuration file. While I agree that there should be some changes to mitigate such problems it was a policy/config file that the existing untouched driver was reading and then causing the crash (so no restore point was created).
- jenadine 2y agoFrom what I understand, the problem was not caused by an update of the driver itself, but an update of a config file that the driver uses. As an OS author, how could you possibly know what to rollback when this is just an unrelated file fron a third party? Maybe you could try to rollback the whole file system to a previous snapshot? Assuming the file system supports automated snapshots, that might work, but this also has costs.
- russellbeattie 2y agoOh, I didn't know that it was just a config file, thanks. I'm not sure if this makes it better though. The idea that an update to a single text file used by a third party Windows service can take down the whole OS permanently is a bit extreme, no? Windows BSODs have been a reality for a long as it has existed. There's no reason at this point any third party software should be able to cause it. Hardware fault? Sure. Badly installed or configured driver? Crazy.
- amluto 2y agoI’m not a regulator, but I think the solution may actually be to break up Microsoft. Right now, there is a product that is critical to the economy: Windows. By “Windows” I mean the OS, its security mechanisms, and its update mechanisms. Changing Windows to a multi-source model seems challenging, to say the least. Right now, though, Windows is not merely single-source, but that single source also makes OneDrive, Office, a not-very-secure cloud offering, ads, AI, etc. Most of the revenue comes from crap layered on top of Windows. If just the base Windows were split out, then the company behind it could focus on making a secure base. Maybe they could actively mitigate attacks, even from the rest of the layers (e.g. the “AI” recording crap, OneDrive, telemetry, etc). And maybe CrowdStrike would become unnecessary because the Windows company itself could offer adequate endpoint security. Getting this right would be hard, but having the base OS for much of the world in the hands of Microsoft is not going so well.
- jacooper 2y agoIronically I think Microsoft losing windows won't hurt them that much, it will however benefit consumers for sure.
- seanmcdirmid 2y agoI don’t think Windows would survive for very long without other Microsoft businesses subsidizing their revenue. It might go on for a few years, but it would basically move up Linux and OSX quickly to corporate desktop status, while Windev goes bankrupt as a non-viable business.
- amluto 2y agoThe monetization model would indeed be complicated. But, as an off the cuff estimate, there are several billion Windows installations in the world. A small fee (say $2/year on average) would easily cover an excellent engineering operation to maintain Windows. And appropriate regulation could force everyone to use Windows or a similarly independent OS, and the whole industry could survive this.
- deleted 2y ago
- commercialnix 2y ago[flagged]
- shadowgovt 2y agoIn related news, auto manufacturers under fire after aftermarket modifications to mufflers cause engines to burst into flames. Seriously, I don't know what Microsoft was supposed to do about this. People bought an operating system from them, then they gave a third party permission to modify the internals of that operating system's configuration, then those modifications broke their installations. Where is the regulatory intervention story regarding how Microsoft's behavior should change here?
- MrStonedOne 2y ago[dead]
- penguin_booze 2y agoThe saving grace is that this situation was salvageable by mortals. Imagine the world where black box AI systems are deployed, and humanity gets too cozy and complicit with the amenities it offers--too lazy and too convenient to care. Then suddenly, a BSoD-equivalent happens. And nobody knows how to reason with it--or worse, through it; and nobody knows how write a 'hello world' nor to fire up a debugger any more.