4 ms·

A slightly bewildering fact is that CrowdStrike's terms and conditions say not to use it for critical infrastructure: > Neither the offerings nor crowdstrike t

A slightly bewildering fact is that CrowdStrike's terms and conditions say not to use it for critical infrastructure: > Neither the offerings nor crowdstrike tools are for use in the operation of aircraft navigation, nuclear facilities, communication systems, weapons systems, direct or indirect life-support systems, air traffic control, or any application or installation where failure could result in death, severe physical injury, or property damage. (Originally in all-caps, presumably to make it sound more legally binding) https://www.crowdstrike.com/terms-conditions/ https://www.crowdstrike.com/terms-conditions/

lbourdages 2y ago
That's a pretty standard clause I've seen in every software ToS I ever gazed my eyes upon. As far as I know, those applications weren't affected either - airports were affected because the ticketing systems were offline. Companies not using Crowdstrike were able to fly just fine. Edit: 911 was affected in many places, and that is definitely concerning as it is very much life critical.
- Retr0id 2y ago
  Sure, the small-print is always going to say "anything bad that happens is someone else's fault", but it's a bit embarrassing when you put it next to their marketing materials.
  - 01HNNWZ0MV43FF 2y ago
    I recently was asked to sign a thing saying it's my fault if I die while getting my hair colored
    - gibbitz 2y ago
      Oddly this is a thing: https://en.m.wikipedia.org/wiki/Vertebrobasilar_insufficiency https://en.m.wikipedia.org/wiki/Vertebrobasilar_insufficienc...
      - 01HNNWZ0MV43FF 2y ago
        Interesting! Happy to report I survived
  - 1vuio0pswjnm7 2y ago
    "Sure the small-print is always going to say "anything bad that happens is someone else's fault", ..." But that's not what this "small-print" says, i.e., the text you quoted and the terms and conditions page linked to in your comment. Generally, it is not possible to disclaim liability for death, physical injury or property damage. The Crowdstrike disclaimer does not attempt to do so. Nor do the terms ask the software user to assume any risk of death, physical injury or property damage. (Except for a warning about using "Malware Samples".)
lupire 2y ago
Critical infrastructure should not use Internet-enabled machines.
- worthless-trash 2y ago
  I've had this discussion with many people involved in country infra. It falls on deaf ears. They talk about 'acceptable risk' and 'minimizing their long term costs' just to stay afloat while posting multi billion dollar profits. I don't know where the delusion comes from, but some of them to go see the folly of their mistakes in the last few days. They will ride this off in the excuse that 'it affected so many other people, see, its not my fault !'.
  - AmericanChopper 2y ago
    How can you run your internet backbone without connecting it to the internet?
    - worthless-trash 2y ago
      Infrastructure , ie.. water, power, electricity, traffic, dam control, hydrostations, sewerage etc.
      - AmericanChopper 2y ago
        My point is that a lot of critical infrastructure needs to be connected to the internet, including network (as I mentioned) and traffic control systems (as you mentioned).
        worthless-trash 2y ago
        I now see where you stand, and we're going to have to disagree. I've heard all the points that your side can make 20 times over and none of them are convincing. I have also learned that when people use the word "need" they have their minds made up, so no point continuing this discussion, have a good one.
tetris11 2y ago
Do they follow their own terms though, or do they still try to sell this software to hospitals without mentioning the fine print.
- throwaway55671 2y ago
  Do you mean hospitals, 911 dispatch centers and other critical infrastructure buys and deploys software without having the legal department carefully analyze the terms and conditions, based on the marketing materials only?
  - soco 2y ago
    Yes. I just googled and there are a-plenty. Even Crowdstrike has a dedicated offering page for hospitals. Not sure what those legal departments you mentioned are paid for, by the way. Maybe only to silence whistleblowers?
mannykannot 2y ago
Somewhat ironically, what CrowdStrike is doing here and what the author of this article seems to want are two manifestations of the same desire: to be compensated for one's expertise and judgement without bearing any responsibility when it goes wrong. In any reasonably rational system, there should be some sort of balance between the two. That is hard to reach, as the various stakeholders are fundamentally at odds with one another, but it is easily believable that the dev who presses 'deploy' rarely has much of either.
- _xiaz 2y ago
  This is exactly right. Disclaimer inflation has made disclaimers worthless since noone wants to bear responsibility unless absolutely necessary
seiferteric 2y ago
If you think about it, any software update can make something bad happen. Maybe we just shouldn't be running bare-metal installs for critical infra in the first place. Just run a hypervisor taking snapshots daily or before updates and if it bricks a system it restarts into the last good image. Critical infra should be much more resilient and defensive than it is.
- Retr0id 2y ago
  Easier said than done, since a hypervisor is yet another moving part that can fail. People were running Crowdstrike on AWS (which in most (all?) cases involves a hypervisor), and recovery was still painful for them.
- Zambyte 2y ago
  Maybe it'd time to concede that Tanenbaum was right.
- hypeatei 2y ago
  That, or just simplifying these systems with clear boundaries between them. Why are flight status displays running Windows with endpoint security in the first place? Data could be loaded periodically from one authorized machine/job on the network with all other outbound/inbound network access restricted.
- giantg2 2y ago
  That only works if it's self contained. As soon as you need to reach out and interact with other systems, version mismatches can still cause issues even if your system hasn't changed. Integration points and input are the biggest points of failure or vulnerabilities. A system that doesn't take input or integrate with others is super easy to maintain (of course most are practically useless too).
- alexlll862 2y ago
  your hypervisor needs security updates too.
CoastalCoder 2y ago
What does the law say about situations where a salesman's promises are at odds with the EULA?
- lanthade 2y ago
  My bet is all it says is the lawyers will be getting rich.
belter 2y ago
And the Windows license terms, offers no guarantees of any kind, while it seems from this outage, is used at 911 response centers and hospitals emergency and surgery rooms... " Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the devicemanufacturer and installerexclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement..." https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...
SebFender 2y ago
These days - similar clauses won't hold.

lbourdages 2y ago

That's a pretty standard clause I've seen in every software ToS I ever gazed my eyes upon. As far as I know, those applications weren't affected either - airports were affected because the ticketing systems were offline. Companies not using Crowdstrike were able to fly just fine. Edit: 911 was affected in many places, and that is definitely concerning as it is very much life critical.

Retr0id 2y ago
Sure, the small-print is always going to say "anything bad that happens is someone else's fault", but it's a bit embarrassing when you put it next to their marketing materials.
- 01HNNWZ0MV43FF 2y ago
  I recently was asked to sign a thing saying it's my fault if I die while getting my hair colored
  - gibbitz 2y ago
    Oddly this is a thing: https://en.m.wikipedia.org/wiki/Vertebrobasilar_insufficiency https://en.m.wikipedia.org/wiki/Vertebrobasilar_insufficienc...
    - 01HNNWZ0MV43FF 2y ago
      Interesting! Happy to report I survived
- 1vuio0pswjnm7 2y ago
  "Sure the small-print is always going to say "anything bad that happens is someone else's fault", ..." But that's not what this "small-print" says, i.e., the text you quoted and the terms and conditions page linked to in your comment. Generally, it is not possible to disclaim liability for death, physical injury or property damage. The Crowdstrike disclaimer does not attempt to do so. Nor do the terms ask the software user to assume any risk of death, physical injury or property damage. (Except for a warning about using "Malware Samples".)

lupire 2y ago

Critical infrastructure should not use Internet-enabled machines.

worthless-trash 2y ago
I've had this discussion with many people involved in country infra. It falls on deaf ears. They talk about 'acceptable risk' and 'minimizing their long term costs' just to stay afloat while posting multi billion dollar profits. I don't know where the delusion comes from, but some of them to go see the folly of their mistakes in the last few days. They will ride this off in the excuse that 'it affected so many other people, see, its not my fault !'.
- AmericanChopper 2y ago
  How can you run your internet backbone without connecting it to the internet?
  - worthless-trash 2y ago
    Infrastructure , ie.. water, power, electricity, traffic, dam control, hydrostations, sewerage etc.
    - AmericanChopper 2y ago
      My point is that a lot of critical infrastructure needs to be connected to the internet, including network (as I mentioned) and traffic control systems (as you mentioned).
      - worthless-trash 2y ago
        I now see where you stand, and we're going to have to disagree. I've heard all the points that your side can make 20 times over and none of them are convincing. I have also learned that when people use the word "need" they have their minds made up, so no point continuing this discussion, have a good one.

tetris11 2y ago

Do they follow their own terms though, or do they still try to sell this software to hospitals without mentioning the fine print.

throwaway55671 2y ago
Do you mean hospitals, 911 dispatch centers and other critical infrastructure buys and deploys software without having the legal department carefully analyze the terms and conditions, based on the marketing materials only?
- soco 2y ago
  Yes. I just googled and there are a-plenty. Even Crowdstrike has a dedicated offering page for hospitals. Not sure what those legal departments you mentioned are paid for, by the way. Maybe only to silence whistleblowers?

mannykannot 2y ago

Somewhat ironically, what CrowdStrike is doing here and what the author of this article seems to want are two manifestations of the same desire: to be compensated for one's expertise and judgement without bearing any responsibility when it goes wrong. In any reasonably rational system, there should be some sort of balance between the two. That is hard to reach, as the various stakeholders are fundamentally at odds with one another, but it is easily believable that the dev who presses 'deploy' rarely has much of either.

_xiaz 2y ago
This is exactly right. Disclaimer inflation has made disclaimers worthless since noone wants to bear responsibility unless absolutely necessary

seiferteric 2y ago

If you think about it, any software update can make something bad happen. Maybe we just shouldn't be running bare-metal installs for critical infra in the first place. Just run a hypervisor taking snapshots daily or before updates and if it bricks a system it restarts into the last good image. Critical infra should be much more resilient and defensive than it is.

Retr0id 2y ago
Easier said than done, since a hypervisor is yet another moving part that can fail. People were running Crowdstrike on AWS (which in most (all?) cases involves a hypervisor), and recovery was still painful for them.
Zambyte 2y ago
Maybe it'd time to concede that Tanenbaum was right.
hypeatei 2y ago
That, or just simplifying these systems with clear boundaries between them. Why are flight status displays running Windows with endpoint security in the first place? Data could be loaded periodically from one authorized machine/job on the network with all other outbound/inbound network access restricted.
giantg2 2y ago
That only works if it's self contained. As soon as you need to reach out and interact with other systems, version mismatches can still cause issues even if your system hasn't changed. Integration points and input are the biggest points of failure or vulnerabilities. A system that doesn't take input or integrate with others is super easy to maintain (of course most are practically useless too).
alexlll862 2y ago
your hypervisor needs security updates too.

CoastalCoder 2y ago

What does the law say about situations where a salesman's promises are at odds with the EULA?

lanthade 2y ago
My bet is all it says is the lawyers will be getting rich.

belter 2y ago

And the Windows license terms, offers no guarantees of any kind, while it seems from this outage, is used at 911 response centers and hospitals emergency and surgery rooms... " Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the devicemanufacturer and installerexclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement..." https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...

SebFender 2y ago

These days - similar clauses won't hold.