3 ms·

You're right, but I don't think it changes anything. Third party software bringing anything new in needs to go through a test phase. That could be automated and

You're right, but I don't think it changes anything. Third party software bringing anything new in needs to go through a test phase. That could be automated and a simple 30 minute VM boot, regular tasks run, and a longer 24 hour one running in the background whilst you start rolling updates. Either way, it's unacceptable for critical services to be beholden to the validation of a third party upstream. The companies in question are responsible for that negligent handing off of ownership.

gruez 2y ago
>Third party software bringing anything new in needs to go through a test phase. That could be automated and a simple 30 minute VM boot, regular tasks run, and a longer 24 hour one running in the background whilst you start rolling updates. I don't think anyone is going to disagree that's engineering best practice and should theoretically be done, but how is microsoft going to enforce this? Do you want to force developers wanting to publish software for windows to undergo annual audits (soc-2 style) to confirm that all the engineering best practices are indeed being followed? Not even Apple is that strict.
- averageRoyalty 2y ago
  I don't understand why people keep bringing Microsoft into this. This testing is the responsibility of the company whose computer fleet it is. They have many upstream software vendors - often 10s or 100s - and should be doing this testing every time. You should never rely on the vendor to test (evidently). I'd go so far as to assume all vendor updates are hostile and build your test model against that. Automated testing of new software in companies with 10k+ desktops (which covers most affected companies here) should be as common as password policies or email attachment policies. If the vendor implements things in a way that doesn't allow this style of testing, they don't meet security requirements and another should be found.
- stefan_ 2y ago
  Stop signing CrowdStrokes shitty kernel driver? Because that's what made the thing load. That is also pretty much the Apple way nowadays.
  - gruez 2y ago
    See my previous comment: "how is microsoft going to enforce this? Do you want to force developers wanting to publish software for windows to undergo annual audits (soc-2 style) to confirm that all the engineering best practices are indeed being followed? Not even Apple is that strict." Or are you saying that they should ban EDR vendors from installing drivers at all? How are you going to implement the invasive monitoring needed for EDR to work?
    - stefan_ 2y ago
      I don't think you understand what a kernel driver is. Apple won't sign yours full stop and Microsoft already has a certification program in place.
      - deleted 2y ago
        [deleted]
      - gruez 2y ago
        >Microsoft already has a certification program in place. And you think Crowdstrike's driver isn't signed? Given all drivers have to be signed for windows to load it, I highly doubt that's the case. Moreover, I doubt WHQL's testing covers logic bugs. Graphics drivers crash all the time for instance, and they're definitely WHQL certified. You could inspect the code even harder, but that just goes into my previous question.

gruez 2y ago

>Third party software bringing anything new in needs to go through a test phase. That could be automated and a simple 30 minute VM boot, regular tasks run, and a longer 24 hour one running in the background whilst you start rolling updates. I don't think anyone is going to disagree that's engineering best practice and should theoretically be done, but how is microsoft going to enforce this? Do you want to force developers wanting to publish software for windows to undergo annual audits (soc-2 style) to confirm that all the engineering best practices are indeed being followed? Not even Apple is that strict.

averageRoyalty 2y ago
I don't understand why people keep bringing Microsoft into this. This testing is the responsibility of the company whose computer fleet it is. They have many upstream software vendors - often 10s or 100s - and should be doing this testing every time. You should never rely on the vendor to test (evidently). I'd go so far as to assume all vendor updates are hostile and build your test model against that. Automated testing of new software in companies with 10k+ desktops (which covers most affected companies here) should be as common as password policies or email attachment policies. If the vendor implements things in a way that doesn't allow this style of testing, they don't meet security requirements and another should be found.
stefan_ 2y ago
Stop signing CrowdStrokes shitty kernel driver? Because that's what made the thing load. That is also pretty much the Apple way nowadays.
- gruez 2y ago
  See my previous comment: "how is microsoft going to enforce this? Do you want to force developers wanting to publish software for windows to undergo annual audits (soc-2 style) to confirm that all the engineering best practices are indeed being followed? Not even Apple is that strict." Or are you saying that they should ban EDR vendors from installing drivers at all? How are you going to implement the invasive monitoring needed for EDR to work?
  - stefan_ 2y ago
    I don't think you understand what a kernel driver is. Apple won't sign yours full stop and Microsoft already has a certification program in place.
    - deleted 2y ago
      [deleted]
    - gruez 2y ago
      >Microsoft already has a certification program in place. And you think Crowdstrike's driver isn't signed? Given all drivers have to be signed for windows to load it, I highly doubt that's the case. Moreover, I doubt WHQL's testing covers logic bugs. Graphics drivers crash all the time for instance, and they're definitely WHQL certified. You could inspect the code even harder, but that just goes into my previous question.