4 ms·
One thing I am surprised no one has been discussing is the role Microsoft have played in this and how they set the stage for the CrowdStrike outage through a la
by apatheticonion 2y ago
One thing I am surprised no one has been discussing is the role Microsoft have played in this and how they set the stage for the CrowdStrike outage through a lack of incentive (profit, competition) to make Windows resilient to this sort of situation.
While they were not directly responsible for the bug that caused the crashes, Microsoft does hold an effective monopoly position over workstation computing space (I'd consider this as infrastructure at this point) and therefore have a duty of care to ensure the security/reliability and capabilities of their product.
Without competition, Microsoft have been asleep at the wheel on innovations to Windows - some of which could have prevented this outage.
For example; Crowdstrike runs in user space on MacOS and Linux - does Windows not provide the capabilities needed to run Crowdstrike in user space?
What about innovations in application sandboxing which could mitigate the need for level of control CrowdStrike requires?
The fact is; Microsoft is largely uncontested in holding the keys to the world's computing infrastructure and they have virtually no oversight.
Windows has fallen from making over 80% of Microsoft's revenue to 10% today - there is nothing wrong with being a private company chasing money - but when your product is critical to the operation of hospitals, airlines, critical infrastructure, you can't be out there tickling your undercarriage on AI assistants and advertisements to increase the product's profitability.
IMO Microsoft have dropped the ball on their duty of care to consumers and CrowdStrike is a symptom of that. Governments need to seriously consider encouraging competition in the desktop workspace market. That, or regulate Microsoft's Windows product
- DaoVeles 2y agoAbsolutely. This is a failure on multiple fronts. It is a sign of system rot that has been going on for decades now. The one upside of the fall of revenue share from Windows is that it means that MS probably won't hold it as an untouchable sacred cow any more.
- intern4tional 2y agoSo the grandparent poster has a fundamental misunderstanding of how Windows works, and why CrowdStrike has a kernel driver in the first place. Microsoft has long desired to kick AV vendors out of kernel space and has even attempted to do so prior, however because of its dominant position in the market, it is unable to do so. I was at MS when an iteration of this effort was underway, and the EU said no. See, Windows is a highly regulated OS today, and making a change like kicking out AV vendors from the kernel runs afoul of antitrust laws. Example: https://www.techtarget.com/searchsecurity/news/450420491/Microsoft-accused-of-blocking-independent-antivirus-competition https://www.techtarget.com/searchsecurity/news/450420491/Mic... Microsoft does provide user-space capabilities: https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal https://learn.microsoft.com/en-us/windows/win32/amsi/antimal... but vendors are not required to use it, nor can Microsoft require vendors to use it (for the aforementioned antitrust reasons). Microsoft also has ELAM: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware https://learn.microsoft.com/en-us/windows-hardware/drivers/i... which is a rootkit / bootkit defensive mechanism. A defect in the definition files (as noted in the twitter thread) is what caused the crash in an ELAM driver. CrowdStrike obviously was not following the required process for ELAM drivers. Mind you, the claim about CrowdStrike not impacting Linux is also bogus: https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/ https://www.neowin.net/news/crowdstrike-broke-debian-and-roc...
- apatheticonion 2y agoAll good points, I might have been slightly over-impassioned and under-informed in my original rant (though still salty at Microsoft's assault on the usability of Windows). My understanding was that CrowdStrike breaking on Debian was actually the motivation for them moving to user-space on Linux. I'm surprised that, assuming they have the capability to do so, they haven't done the same on Windows.
- deleted 2y ago[deleted]