8 ms·
Microsoft says 8.5M Windows devices were affected by CrowdStrike outage
- lwhi 2y ago[flagged]
- trothamel 2y agoNo. Software freedom 0 is that you should be free to run the program as you wish, for any purpose. If that means loading your system up with third-party crapware, that's on you, not them. That doesn't mean Microsoft shouldn't work on making it easy to recover a system, if they can, but preventing you from running software would make the cure worse that the disease.
- LadyCailin 2y agoAbsolutely not. If they did, we would immediately have a walled garden. We’re moving too far in that direction already, we don’t need to give Microsoft an excuse to jump there immediately. If you install stupid shit on your computer, that’s on you, not Windows, not MacOS, not Linux.
- asveikau 2y agoIf you install some pointless garbage as root on a free OS, it can make your system unbootable. I don't think an OS vendor has any blame here. The mistake here is people think they need third party security solutions that are actually worse than nothing.
- belter 2y agoShould MS hold liability for selling a system who needs additional 3rd party components to be considered secure?
- hipadev23 2y agoCrowdstrike doesn’t make anything secure. It’s the same smoke and mirrors bullshit they were selling in the early 00’s via Norton or McAfee. It slows down machines in the best case and periodically renders them inoperable.
- gruez 2y ago>Crowdstrike doesn’t make anything secure. It's not security pixie dust, and might introduce more security vulnerabilities itself, but it's probably pretty good at preventing Alice from accounting from running a random macro-enabled excel file with a malicious payload.
- iowemoretohim 2y agoCrowdstrike is also used on Linux and MacOS devices. So by your definition, does that means they aren't considered secure either? Crowdstrike is certainly not required for a device to be considered secure, it is a tool that uses AI and ML to detect and prevent malware, 0-day exploits and other cyber threats in real-time across endpoints.
- belter 2y ago> uses AI and ML No it does not. Such thing does not exist. Most antivirus programs rely primarily on signature-based detection and heuristic analysis rather than advanced machine learning algorithms. While some modern antivirus solutions incorporate basic machine learning for anomaly detection, they do not typically employ the sophisticated, self-learning AI systems that are characteristic of true artificial intelligence applications. And I do understand Crowdstrike is more than just an antivirus. Please don't repeat CNBC Stock market pumping memes. No they are not an "AI Stock"
- teeray 2y agoif you burn out the engine of your car with third-party tuning chips, would auto manufacturers cover that under warrantee?
- mschuster91 2y agoTo keep up your analogy, it can be said that Microsoft delivers a 2024 sports car with a 1980s naturally-aspirated diesel engine. If Microsoft had done their job instead of inventing new UI frameworks basically for each recent Windows release, there would be no need for an antivirus engine at all.
- HPsquared 2y agoIs there really a need for antivirus software anyway? What does it actually prevent?
- numpad0 2y agoI think it's actually one of MS moats that you can do this on Windows. This had been much harder on macOS, and practically impossible on iOS; considering that few business take those OS seriously, it's most likely a requirement than a flaw.
- LadyCailin 2y agoI vote we stop putting George Kurtz in charge of things.
- 2OEH8eoCRo0 2y agoHis methods are unsound
- radicaldreamer 2y agoIt seems like he doesn’t learn from postmortems or mistakes. Can’t blame him though, the incentives are aligned so he doesn’t have to
- belter 2y agoThat is why he was only paid $47 million last year. He is an under performer...
- aunty_helen 2y agoI don't see any method at all, sir.
- 2OEH8eoCRo0 2y agoyes!
- belter 2y agoHe tried to take down the world before...He was given a second chance...I say he will try a third time... "This is the 2nd time CrowdStrike CEO George Kurtz has been at the center of a global tech failure" - https://www.businessinsider.com/crowdstrike-ceo-george-kurtz-tech-outage-microsoft-mcafee-2024-7?international=true&r=US&IR=T https://www.businessinsider.com/crowdstrike-ceo-george-kurtz...
- etc-hosts 2y agoHe should become Adam Neumann's CTO.
- 2y ago
- oddb0d 2y ago[flagged]
- heyitsguay 2y agoJust for the sake of discussion, as a long time Linux user (but never a Crowdstrike user) -- is there anything about this outage that could only have happened on Windows? If the update had been broken in another way, could it have crashed all Ubuntu machines, or all Macs? Not excusing what happened in any way, I'm just curious.
- vdfs 2y agoDid already happen https://news.ycombinator.com/item?id=41018029 https://news.ycombinator.com/item?id=41018029 and https://news.ycombinator.com/item?id=41005936 https://news.ycombinator.com/item?id=41005936
- lwhi 2y agoLinux doesn't have a BSOD .. is this the equivalent of a kernel panic?
- vdfs 2y agosystemd, a software suite providing system components for the Linux operating systems, implements a blue screen of death similar to those of Microsoft Windows using a systemd unit called systemd-bsod since August 2023, which was fully added on December 6, 2023 starting with version 255 of systemd.[36] It does not replace the kernel panic featured within Linux (see below); rather, it is only used in the event of a boot failure. https://en.wikipedia.org/wiki/Blue_screen_of_death#Linux https://en.wikipedia.org/wiki/Blue_screen_of_death#Linux
- yjftsjthsd-h 2y agoIt does now: https://www.phoronix.com/news/Linux-DRM-Panic-BSoD-Picture https://www.phoronix.com/news/Linux-DRM-Panic-BSoD-Picture But yeah, kernel panics or the equivalent happen to ~all OSs.
- 2y ago
- Gys 2y agoI wonder how they came to this number? And how reliable is it? It is very quick and relatively a very small number. Very convenient for damage management.
- morkalork 2y agoWindows has telemetry out the wazoo doesn't it?
- breadwinner 2y agoBut Windows has to boot before it can send telemetry, right?
- sys_64738 2y agoDoes IME contact just Intel or also M$?
- iowemoretohim 2y agoDevice that was sending telemetry data with Crowdstrike installed and is no longer sending telemetry data after the event time frame can be considered to be affected. Another possible source is Crowdstike itself who definitely has the data.
- deleted 2y ago[deleted]
- attentive 2y agolack of signal is also a signal
- surfingdino 2y agoThey asked ChatGPT.
- belter 2y agoMicrosoft is just jealous, it took the focus from their large Azure outage, also on Friday: "Major Microsoft 365 outage caused by Azure configuration change" - https://www.bleepingcomputer.com/news/microsoft/major-microsoft-365-outage-caused-by-azure-configuration-change/ https://www.bleepingcomputer.com/news/microsoft/major-micros... To compensate and keep the focus on them, as masters of all outages...They will take at least until Tuesday, (according to their own info...) to fix the current ongoing issue with Teams scheduling: https://portal.office.com/servicestatus https://portal.office.com/servicestatus
- hipadev23 2y agocant have an office outage when you can’t boot into windows
- 9029 2y agoWhat if I told you the cause was a failure of a dependency running CrowdStrike
- belter 2y agoThen I would say they should read their own blog post: "...a reminder of how important it is for all of us across the tech ecosystem to prioritize operating with safe deployment and disaster recovery using the mechanisms that exist..." https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/ https://blogs.microsoft.com/blog/2024/07/20/helping-our-cust...
- kreeben 2y agoFrom your linked piece: "CrowdStrike has helped us develop a scalable solution that will help Microsoft’s Azure infrastructure accelerate a fix" What if I told you that such Mag7 speak is not to be trusted, at all, even?
- cosmotic 2y agoMuch of the media has reported the crowdstrike mess as a Microsoft problem (because it only affected Windows hosts). Even still, this is not a good look for Windows. In no way is Microsoft happy about the crowdstrike situation.
- dgrin91 2y agoThat sounds low... Really low. E.g. NYC has ~350k employees and I know they got hit hard. Not all of them have windows machines, but let's say 100k do. I know they basically all have falcon installed. That's 100k in just one org, not even counting their windows servers. How many Fortune 500s are mainly Windows? Edit: I did some back of napkin math. ~30 million work for a fortune 500. Let's say 2/3rds of those have a Windows desktop provided by employer, so ~20M. I think I read crowdstrike has about ~25% market share, so that's 5 mil just in fortune 500. No way it's just 8.5M
- bongodongobob 2y agoWindows AND Crowdstrike. I work for a pretty large corporation and the only effects for us was a few third party applications. We use M365 extensively and didn't see any issues there at all either.
- taberiand 2y agoDo they run crowdstrike though?
- tomrod 2y ago22% market share of the corporate anti-virus market, I read. Its not only big corps, but hospitals, governments, mom and pops. Crowdstrike was baaaaaaad.
- llm_trw 2y ago>How many Fortune 500s are mainly Windows? Front end or back end? Because the backend hasn't been windows in most places for a very long while.
- dgrin91 2y agoYou would be surprised. Yes Linux dominates, but there are many millions, easily billions of windows backend servers
- 2y ago
- averageRoyalty 2y agoAnother article blaming the upstream vendor and not bothering to put any onus on the horrible security practices of companies allowing auto updating of executable code in production on critical systems. This is unacceptable practice. I understand non tech media not getting it, but this lack of awareness from tech news is sad.
- axlee 2y agoYou want your antivirus to be autoupdating.
- mr90210 2y agoBy now I’d expect people including you to have a more sophisticated perspective about third-party software. Yesterday was a catastrophe and you are still stuck with such naive and simplistic view: you want your antivirus to be auto updating.
- mewpmewp2 2y agoHow can an anti virus software protect from new threats if it can't auto update as soon as new threat is there?
- averageRoyalty 2y agoIt's a trade off. That said, we're in an age where companies do 100+ pushes per day. Automate a build, run a test, then deploy rolling updates across the fleet. The options aren't "everyone auto updates or no updates for weeks", there's a balance point. It's very clear what choice most critical companies this week did though.
- nikau 2y agoCrazy idea, for critical systems dont give them blanket internet access, USB, email attachments...
- 2y ago
- Quaranqi 2y agoThat is 0001.5-M out of 1400.0-M windows devices in all. That is about -.1% of all the MS machines. As a linux user, I dont understand the big deal, the effects of this.
- ecshafer 2y agoThe issue wasn't necessarily the number of machines, but which machines were affected. The fact the major airlines were forced to ground planes, is an indication this was bad. Several financial companies couldn't trade. Hospitals couldn't function. I was personally unable to pump gas. As a linux user, I don't see how you don't see this was a huge deal.
- surfingdino 2y agoMonocultures die fast and without survivors.
- dmd 2y agoSo my org (a random medium-sized healthcare system), with ~100k seats, was more than 1% of the devices? I don't buy it.
- m3kw9 2y agoMaybe I would think most non businesses will not need falcon sensor, and more critical systems will be the ones actually using it. So their “low” numbers are actually high if you only look at businesses or critical systems
- steveBK123 2y agoOff by an order of magnitude for sure. I've heard of 250k employee companies where people got a snow day off this.
- xyst 2y agoThe ClownStrike Paid Holiday
- xyst 2y agoThis outage (fuck up) impacted critical workflows. Lawyers should be foaming at the mouth to get a class action lawsuit going if criminal penalties are not applicable. Hospitals - physicians/doctors/nurses lost access to critical equipment. Patients may have suffered degraded care as well. Reports of this outage impacting active surgeries. Patients forced to reschedule appointments around ClownStrike Airlines - many flights grounded. Delays, delays, delays. Wasted fuel, time. Loss of revenue due to rescheduled flights, refunding customers. Local airports flooded with grounded flights, increased personnel to deal with it. FAA stressed. Banks - many people lost access to money. Frustration for people trying to get access to pay bills, or get paid themselves.
- sys_64738 2y agoLawsuits against whom? Certainly won't be Micro-Soft and this Crowd Strike or whoever as their ToS say use their software "as-is" without any implied warranty.
- someonehere 2y agoWhat saved my company from this is the recommended policy I’ve had the last three companies I’ve implemented this in. N -1. The first time I ever rolled out Falcon, the sales engineer said, “if you want to be on the latest when it releases, choose this policy. Generally customers like to be one release (N -1) behind. This is the safest option in my experience. We rarely have issues but this is the way to prevent issues if we do ship something bad.” I’ve been telling other admins this is the safest option moving forward. I don’t see a need for my org to run bleeding edge releases of newer products. This also applies to OS updates unless it’s a zero day. Major OS releases I wait for the first .1 update to release. Currently doing this with Ubuntu Desktop 24 LTS as it shipped with missing features from 22 and a broken autosetup functionality. August is the first update to 24 LTS and we’ll test and determine if the bugs have been squashed. I can’t think of any way to always be on the latest upgrade of anything critical. All of these companies were on the bleeding edge release of CrowdStrike and it brought a lot down globally.
- xyst 2y ago(N-1) release is recommended on any product/software that cannot be independently monitored (ie, proprietary shit).
- cgb_ 2y agoN-1 didn't save you, nor did N-2: https://news.ycombinator.com/item?id=41015038 https://news.ycombinator.com/item?id=41015038 > "b) Since n, n-1 and n-2 versions of the sensor all died equally spectacularly, that bug as been around for at least three versions of csagent.sys." There's so much misinformation around this Crowdstrike issue. The change deployed was in what is referred to as a "channel file" which isn't part of the software update mechancism (what you call N-X) but part of the intra-day frequent signature/channel updates it gets (that we all have no control over). Crowdstrike are calling it an unfortunate "logic error" but they and few others are talking about the how a binary payload could get released to the public without seemingly any pre-release testing of the payload. If the content that was made available to the public had ran on a test endpoint, they would have discovered this "logic error" before taking down a high number of the world's systems simultaneously.