4 ms·

The hospitals, airlines, police, etc. that bought into CrowdStrike should have primary responsibility. I wouldn't want to live in a world where they can say "bu

The hospitals, airlines, police, etc. that bought into CrowdStrike should have primary responsibility. I wouldn't want to live in a world where they can say "but McKinsey said it was okay" and wash their hands of this, while pinning all the blame on CS.

lupusreal 2y ago
Yeah, why should software companies ever be held to some sort of standard? Let the buyer beware! Oh but don't call me a programmer, I'm totally a software engineer and don't you forget it. /s
- keybored 2y ago
  I’ve never asked to be called an engineer. I guess I’m off the hook.
Ekaros 2y ago
They should pay. And then the CrowdStrike and their shareholders should pay to them. We really should just simply remove corporate veil. Make the shareholders at least pay monetarily if not in prison time.
- gsquaredxc 2y ago
  CRWD is a member of the S&P 500. Are you truly suggesting that every holder of the S&P 500 should be put in prison? Realistically, this means that nearly every American and a very large number of international average workers just trying to save for their retirement would have to go to jail. Sounds like a good way to inflate those private prison stocks.
  - MrVandemar 2y ago
    See, that's the way the system has been crafted. Letting theives/incompetents get away with their mistakes/crimes is tightly coupled to people getting money for retirement. Who's gonna rock that boat? People are now literally invested in in a system that tolerates, if not ofttimes rewards, bad behavior from companies all the way from small things right up to "deliberately poisoning/cooking the whole ecosystem to make a buck"
- 1992spacemovie 2y ago
  Yeah calm down chief. You sound 13 and cool.
- surgical_fire 2y ago
  Very edgy. I am a shareholder in dozens of companies. I have zero oversight on how things are managed. The only thing I can do is sell my paltry amount of shares if I think things are not going well there. Shareholders would be punished in this case in the sense that crippling fines and reparations that Crowdstrike should definitely be liable to pay would decimate the stock value. And if criminal charges were to be pressed, then the people actually in charge of the company should be on the hook. For example, if someone dies because CS was horribly negligent in their duties, then that should be a possibility.
c0n5pir4cy 2y ago
Agree with the sentiment of not hiding behind vendors for issues, but in this case there were (presumably) major procedure failures at CrowdStrike which lead to this - I believe they are 100% at fault in this case.
anonzzzies 2y ago
I don’t get it; in most professions, if you deliver crap, you are liable. Why is this different? How is the onus on the buyer who got told this product protects them and then the product actually screws them? I think CS should pay damages and go bankrupt, so others might think twice in the future. I wouldn’t want to live in a world where people can get away with mistakes like this: as far as I have seen, if one person in CS had actually tried this file on their local windows machine, it would’ve crashed. That’s not a small thing is it? That’s a Boeing like culture which should be terminated today.
- Ekaros 2y ago
  It is one thing if these updates were in hands of the IT of the companies, but that this company just could automatically push them over is just weird. I accept shared responsibility when there is some agreed deployment and such scenarios, but here? Nope it is on CrowdStrike...
  - prepend 2y ago
    If you hand your car keys to a drunk driver, it’s on both of you. If I give root to a third party, then I’m liable for everything they do with that root.
    - zakki 2y ago
      The guy was not drunk when the key was given.
      - prepend 2y ago
        I’ve seen crowdstrike’s process. Seems drunk to me.
    - anonzzzies 2y ago
      If I hand over my car keys to the same cleaning companies every month and all is fine always, except this last time, the cleaner cuts the break lines while cleaning the under side and I die in a crash.
smt88 2y ago
> The hospitals, airlines, police, etc. that bought into CrowdStrike should have primary responsibility This is ridiculous. None of these business can (or should) handle all of their infosec internally. They must use vendors. And because they don't have infosec expertise, they have no way to verify that a vendor has good quality control. You're essentially arguing that a hospital should also be responsible if people die because they bought the wrong MRI machine brand or one of their trucking suppliers had a crash and couldn't bring them enough of a certain drug. There is no universe where vendors shouldn't be responsible for failing to deliver a safety-critical service that they 100% guaranteed they could deliver. There was nothing in the CrowdStrike contract that said, "Updates may inadvertently disable all systems that receive them," because that would mean no one should ever use it.
- prepend 2y ago
  Hospitals shouldn’t use vendors like this. They need to be able to audit and understand what they’re doing and not allow. Hospitals have CIOs and CMIOs and CHIOs to make these kinds of decisions.
  - guenthert 2y ago
    Computer security is clearly not the core competency of hospitals, nor should it need to be. I'd argue, putting Internet connected systems running MS Windows in the critical path was already setting them up for failure.
    - figassis 2y ago
      I would say every company of a certain size or criticality should have a proper IT team. It does not even need to be large, but they need to have the expertise and authority to veto certain decisions. I often see vendor deals being made solely for the discount and other marketing crap, like getting another piece of service free as a bonus. IT then gets silenced because number goes up. I have seen situations where leaderhsip keeps asking IT/Engineering the same question "But why can't we just do this?" in different ways and dissecting the answers, asking for reports, and proof, and what not, so that IT is forced to make a bulletproof case against it. It then appears that IT has a personal thing against the vendor. So IT gives up. System is up. Often, part of the problem is the vendor buying lunch to key decision makers and being pals.
locococo 2y ago
I am not familiar with how CS is or can be administered. As a customer you should not have to assume the software your supplier vends is faulty to the extent of this incident. It's reasonable for a customer to assume the software is tested according to industry best practices. CS acted grossly negligent here, and they deserve the majority of the blame. I agree that some blame also resides with customers, there must be disaster recovery procedures in place to allow them to function with minimal downtime in the case of emergency services.
- figassis 2y ago
  I think the problem with DR in this case is you will need to account for every eventuality of every line of code in every sw product you use. Because say, how do you handle the case that your fleet BSODd? Usually you'd rebuild them using your bitlocker keys. But this incident was so deep, that the SPOF here was using Windows. So now, your DR plan needs to account for some mandatory percentage of your OSs not being Windows, and your IT staff being maybe Linux experts. Cool. But can you predict that you need to store your bitlocker keys in both platforms? And can you even do that or is it one of those things where bitlocker storage has to be on windows bc of lockin?
dbs 2y ago
What does McKinsey has to do with it?
- red-iron-pine 2y ago
  consultants spouting industry-standard slop, which means now everyone is on the same platform -- which we've just down doesn't really cover their butts. and to be fair, having some sort of tool like that isn't necessarily a bad thing, the problem is when the tool gets pushed without testing and breaks the internet.
CaptainZapp 2y ago
Mr. Kurtz, is that you?

lupusreal 2y ago

Yeah, why should software companies ever be held to some sort of standard? Let the buyer beware! Oh but don't call me a programmer, I'm totally a software engineer and don't you forget it. /s

keybored 2y ago
I’ve never asked to be called an engineer. I guess I’m off the hook.

Ekaros 2y ago

They should pay. And then the CrowdStrike and their shareholders should pay to them. We really should just simply remove corporate veil. Make the shareholders at least pay monetarily if not in prison time.

gsquaredxc 2y ago
CRWD is a member of the S&P 500. Are you truly suggesting that every holder of the S&P 500 should be put in prison? Realistically, this means that nearly every American and a very large number of international average workers just trying to save for their retirement would have to go to jail. Sounds like a good way to inflate those private prison stocks.
- MrVandemar 2y ago
  See, that's the way the system has been crafted. Letting theives/incompetents get away with their mistakes/crimes is tightly coupled to people getting money for retirement. Who's gonna rock that boat? People are now literally invested in in a system that tolerates, if not ofttimes rewards, bad behavior from companies all the way from small things right up to "deliberately poisoning/cooking the whole ecosystem to make a buck"
1992spacemovie 2y ago
Yeah calm down chief. You sound 13 and cool.
surgical_fire 2y ago
Very edgy. I am a shareholder in dozens of companies. I have zero oversight on how things are managed. The only thing I can do is sell my paltry amount of shares if I think things are not going well there. Shareholders would be punished in this case in the sense that crippling fines and reparations that Crowdstrike should definitely be liable to pay would decimate the stock value. And if criminal charges were to be pressed, then the people actually in charge of the company should be on the hook. For example, if someone dies because CS was horribly negligent in their duties, then that should be a possibility.

c0n5pir4cy 2y ago

Agree with the sentiment of not hiding behind vendors for issues, but in this case there were (presumably) major procedure failures at CrowdStrike which lead to this - I believe they are 100% at fault in this case.

anonzzzies 2y ago

I don’t get it; in most professions, if you deliver crap, you are liable. Why is this different? How is the onus on the buyer who got told this product protects them and then the product actually screws them? I think CS should pay damages and go bankrupt, so others might think twice in the future. I wouldn’t want to live in a world where people can get away with mistakes like this: as far as I have seen, if one person in CS had actually tried this file on their local windows machine, it would’ve crashed. That’s not a small thing is it? That’s a Boeing like culture which should be terminated today.

Ekaros 2y ago
It is one thing if these updates were in hands of the IT of the companies, but that this company just could automatically push them over is just weird. I accept shared responsibility when there is some agreed deployment and such scenarios, but here? Nope it is on CrowdStrike...
- prepend 2y ago
  If you hand your car keys to a drunk driver, it’s on both of you. If I give root to a third party, then I’m liable for everything they do with that root.
  - zakki 2y ago
    The guy was not drunk when the key was given.
    - prepend 2y ago
      I’ve seen crowdstrike’s process. Seems drunk to me.
  - anonzzzies 2y ago
    If I hand over my car keys to the same cleaning companies every month and all is fine always, except this last time, the cleaner cuts the break lines while cleaning the under side and I die in a crash.

smt88 2y ago

> The hospitals, airlines, police, etc. that bought into CrowdStrike should have primary responsibility This is ridiculous. None of these business can (or should) handle all of their infosec internally. They must use vendors. And because they don't have infosec expertise, they have no way to verify that a vendor has good quality control. You're essentially arguing that a hospital should also be responsible if people die because they bought the wrong MRI machine brand or one of their trucking suppliers had a crash and couldn't bring them enough of a certain drug. There is no universe where vendors shouldn't be responsible for failing to deliver a safety-critical service that they 100% guaranteed they could deliver. There was nothing in the CrowdStrike contract that said, "Updates may inadvertently disable all systems that receive them," because that would mean no one should ever use it.

prepend 2y ago
Hospitals shouldn’t use vendors like this. They need to be able to audit and understand what they’re doing and not allow. Hospitals have CIOs and CMIOs and CHIOs to make these kinds of decisions.
- guenthert 2y ago
  Computer security is clearly not the core competency of hospitals, nor should it need to be. I'd argue, putting Internet connected systems running MS Windows in the critical path was already setting them up for failure.
  - figassis 2y ago
    I would say every company of a certain size or criticality should have a proper IT team. It does not even need to be large, but they need to have the expertise and authority to veto certain decisions. I often see vendor deals being made solely for the discount and other marketing crap, like getting another piece of service free as a bonus. IT then gets silenced because number goes up. I have seen situations where leaderhsip keeps asking IT/Engineering the same question "But why can't we just do this?" in different ways and dissecting the answers, asking for reports, and proof, and what not, so that IT is forced to make a bulletproof case against it. It then appears that IT has a personal thing against the vendor. So IT gives up. System is up. Often, part of the problem is the vendor buying lunch to key decision makers and being pals.

locococo 2y ago

I am not familiar with how CS is or can be administered. As a customer you should not have to assume the software your supplier vends is faulty to the extent of this incident. It's reasonable for a customer to assume the software is tested according to industry best practices. CS acted grossly negligent here, and they deserve the majority of the blame. I agree that some blame also resides with customers, there must be disaster recovery procedures in place to allow them to function with minimal downtime in the case of emergency services.

figassis 2y ago
I think the problem with DR in this case is you will need to account for every eventuality of every line of code in every sw product you use. Because say, how do you handle the case that your fleet BSODd? Usually you'd rebuild them using your bitlocker keys. But this incident was so deep, that the SPOF here was using Windows. So now, your DR plan needs to account for some mandatory percentage of your OSs not being Windows, and your IT staff being maybe Linux experts. Cool. But can you predict that you need to store your bitlocker keys in both platforms? And can you even do that or is it one of those things where bitlocker storage has to be on windows bc of lockin?

dbs 2y ago

What does McKinsey has to do with it?

red-iron-pine 2y ago
consultants spouting industry-standard slop, which means now everyone is on the same platform -- which we've just down doesn't really cover their butts. and to be fair, having some sort of tool like that isn't necessarily a bad thing, the problem is when the tool gets pushed without testing and breaks the internet.

CaptainZapp 2y ago

Mr. Kurtz, is that you?