3 ms·

A third party component which used a kernel extension in Windows, but did not need a kernel extension on either the Mac (System Extension, which runs in user sp

A third party component which used a kernel extension in Windows, but did not need a kernel extension on either the Mac (System Extension, which runs in user space) or the Linux (eBPF, much more resistant to crashes) versions. Why would Cloudstrike need a kernel driver on Windows, and not their other platforms? Microsoft is responsible for that design and not moving past it at the pace alternative systems have. Additionally, there are other things Microsoft could have done. For example - if your computer fails to boot 3 times in a row, with a third party driver, how about automatically disabling the driver? If the driver manufacturer doesn’t like that, tell them to suck it up and write a driver that doesn’t crash.

pixel16 2y ago
https://www.theregister.com/2024/07/21/crowdstrike_linux_crashes_restoration_tools/ https://www.theregister.com/2024/07/21/crowdstrike_linux_cra... You mean the same issues that Linux also faced?
- mirashii 2y ago
  The primary one linked there is certainly not the same issue, it was a bug in the Linux kernel's ebpf handling. It happened to be triggered by Crowdstrike, but the bug is undeniably a Linux kernel bug which was subsequently patched, as ebpf programs should never be able to panic the kernel. That's not to say that there haven't been other Crowdstrike fails on Linux, especially pre-eBPF module, but that's not one, and that class of failures has been eliminated in the move to the eBPF based module.
1over137 2y ago
Are you sure "Microsoft is responsible for that design"? Do we know Cloudstrike didn't choose to do it in-kernel even though there was another way they could have done it in userspace?
- ochronus 2y ago
  Yes, as in: allowing (well, requiring?) drivers to run in kernel mode.
  - bongodongobob 2y ago
    It's AV though, if it didn't, it'd be useless.
    - ochronus 2y ago
      In the current architecture, yes. What I'm saying is that architecture is wrong.
tomohawk 2y ago
[flagged]
- CRConrad 2y ago
  > MS is saying they wanted to do the exact same thing, but EU has mandated the access in order to allow multiple products to become rootkits. No. The EU only mandated that Microsoft give other vendors the same access they themselves use to do the same thing. This was the wake-up call to Microsoft to stop doing it that way, and in stead build a more secure API for themselves as well as others to use. But they preferred to sleep through it, for another fifteen years. They didn't “want to do the exact same thing”; if they had wanted to, they could have done it.
- paulmd 2y ago
  wendell level1techs has been talking about how microsoft is specifically moving away from it in Windows on ARM (to some real short-term pain, in fact) so it seems self-serving to assert that they somehow cannot do it because of the EU. if that's the case, presumably their windows-on-arm efforts would have been dinged for it. https://youtu.be/5KHCLBqRrnY?t=5849 https://youtu.be/5KHCLBqRrnY?t=5849 like if apple is doing it, and microsoft is doing it in their ARM build... what is the EU doing or imposing, exactly, that is so problematic for the x86 branch of microsoft? the more reasonable interpretation (ignoring microsoft's excuses) is that microsoft is more constrained by the legacy nature of their x86 product. they can't just sunset it, because it'll break a billion shitty applications that are very important to one specific factory customer running their thing with a kernel hook that is long-since EOL'd or whatever. What they mean is they don't want to, and the EU is just a convenient scapegoat for some unfortunate business realities.
  - throwaway4pp24 2y ago
    Perhaps they are trying to do the same thing as Apple and are claiming Windows on Arm is a separate product that this doesn't apply to.
    - paulmd 2y ago
hulitu 2y ago
> For example - if your computer fails to boot 3 times in a row, with a third party driver, how about automatically disabling the driver? I don't think computers got to that level of refinement. Yes, we have AI, but this is mostly used to spread propaganda. Last i looked, you cannot fix Linux or Windows without human intervention.

pixel16 2y ago

https://www.theregister.com/2024/07/21/crowdstrike_linux_crashes_restoration_tools/ https://www.theregister.com/2024/07/21/crowdstrike_linux_cra... You mean the same issues that Linux also faced?

mirashii 2y ago
The primary one linked there is certainly not the same issue, it was a bug in the Linux kernel's ebpf handling. It happened to be triggered by Crowdstrike, but the bug is undeniably a Linux kernel bug which was subsequently patched, as ebpf programs should never be able to panic the kernel. That's not to say that there haven't been other Crowdstrike fails on Linux, especially pre-eBPF module, but that's not one, and that class of failures has been eliminated in the move to the eBPF based module.

1over137 2y ago

Are you sure "Microsoft is responsible for that design"? Do we know Cloudstrike didn't choose to do it in-kernel even though there was another way they could have done it in userspace?

ochronus 2y ago
Yes, as in: allowing (well, requiring?) drivers to run in kernel mode.
- bongodongobob 2y ago
  It's AV though, if it didn't, it'd be useless.
  - ochronus 2y ago
    In the current architecture, yes. What I'm saying is that architecture is wrong.

tomohawk 2y ago

[flagged]

CRConrad 2y ago
> MS is saying they wanted to do the exact same thing, but EU has mandated the access in order to allow multiple products to become rootkits. No. The EU only mandated that Microsoft give other vendors the same access they themselves use to do the same thing. This was the wake-up call to Microsoft to stop doing it that way, and in stead build a more secure API for themselves as well as others to use. But they preferred to sleep through it, for another fifteen years. They didn't “want to do the exact same thing”; if they had wanted to, they could have done it.
paulmd 2y ago
wendell level1techs has been talking about how microsoft is specifically moving away from it in Windows on ARM (to some real short-term pain, in fact) so it seems self-serving to assert that they somehow cannot do it because of the EU. if that's the case, presumably their windows-on-arm efforts would have been dinged for it. https://youtu.be/5KHCLBqRrnY?t=5849 https://youtu.be/5KHCLBqRrnY?t=5849 like if apple is doing it, and microsoft is doing it in their ARM build... what is the EU doing or imposing, exactly, that is so problematic for the x86 branch of microsoft? the more reasonable interpretation (ignoring microsoft's excuses) is that microsoft is more constrained by the legacy nature of their x86 product. they can't just sunset it, because it'll break a billion shitty applications that are very important to one specific factory customer running their thing with a kernel hook that is long-since EOL'd or whatever. What they mean is they don't want to, and the EU is just a convenient scapegoat for some unfortunate business realities.
- throwaway4pp24 2y ago
  Perhaps they are trying to do the same thing as Apple and are claiming Windows on Arm is a separate product that this doesn't apply to.
  - paulmd 2y ago

hulitu 2y ago

> For example - if your computer fails to boot 3 times in a row, with a third party driver, how about automatically disabling the driver? I don't think computers got to that level of refinement. Yes, we have AI, but this is mostly used to spread propaganda. Last i looked, you cannot fix Linux or Windows without human intervention.