4 ms·

I don’t get it; in most professions, if you deliver crap, you are liable. Why is this different? How is the onus on the buyer who got told this product protects

I don’t get it; in most professions, if you deliver crap, you are liable. Why is this different? How is the onus on the buyer who got told this product protects them and then the product actually screws them? I think CS should pay damages and go bankrupt, so others might think twice in the future. I wouldn’t want to live in a world where people can get away with mistakes like this: as far as I have seen, if one person in CS had actually tried this file on their local windows machine, it would’ve crashed. That’s not a small thing is it? That’s a Boeing like culture which should be terminated today.

Ekaros 2y ago
It is one thing if these updates were in hands of the IT of the companies, but that this company just could automatically push them over is just weird. I accept shared responsibility when there is some agreed deployment and such scenarios, but here? Nope it is on CrowdStrike...
- prepend 2y ago
  If you hand your car keys to a drunk driver, it’s on both of you. If I give root to a third party, then I’m liable for everything they do with that root.
  - zakki 2y ago
    The guy was not drunk when the key was given.
    - prepend 2y ago
      I’ve seen crowdstrike’s process. Seems drunk to me.
  - anonzzzies 2y ago
    If I hand over my car keys to the same cleaning companies every month and all is fine always, except this last time, the cleaner cuts the break lines while cleaning the under side and I die in a crash.
  - Barrin92 2y ago
    That is a nonsensical comparison. Remote software updates and administration are common professional services that consumers of software cannot execute themselves. The correct comparison would be handing your house keys to a licensed insect exterminator and the guy accidentally poisoning your family. You of course are not liable if a professional supplying you with a service messes up.
    - prepend 2y ago
      Crowdstrike doesn’t test their releases. It’s like paying a licensed insect exterminator that uses random chemicals. They tell you this and you hand over the keys anyways.
  - Ekaros 2y ago
    An other view. Tesla does over-the-air updated you don't verify. It disables break, you drive car and kill someone due to this. Do you share responsibility? What if this happens while driving?
- MyFedora 2y ago
  It was a virus definition update, not a software update. CrowdStrike will obviously update their virus definition deployment pre-flight check to prevent a situation like this from happening again, but a staged roll-out is out of the question. What do you want them to do? Expose everyone to new known viruses for longer?
  - thunky 2y ago
    > CrowdStrike will obviously update their virus definition deployment pre-flight check to prevent a situation like this from happening again I don't consider them capable of preventing something like this from happening again.
    - anonzzzies 2y ago
      No worries, it will happen again. That’s why they need to be euthanised.
  - pjmorris 2y ago
    > a staged roll-out is out of the question. What do you want them to do? Expose everyone to new known viruses for longer? I think trading, say, small x (15 minutes, an hour?) time, to stage rather than blast might be an acceptable tradeoff given the visible consequences of not doing so.
andyferris 2y ago
OTOH installing insecure/unstable “security additions” on top of windows should be consider a terrible idea (ie making a bad situation worse). Our essential services should be built on a more secure OS, if windows isn’t suitable.
- thunky 2y ago
  > OTOH installing insecure/unstable “security additions” on top of windows should be consider a terrible idea So it sounds like you agree that Crowdstrike should go bankrupt. > Our essential services should be built on a more secure OS, if windows isn’t suitable Oh wait you blame Windows for this?
  - fuzzfactor 2y ago
    When an IBM mainframe was the routine system, well recognized as a single-point-of-failure, it wasn't a problem like this.
    - thunky 2y ago
      Hate to break it to you: - https://www.crowdstrike.com/blog/crowdstrike-brings-xdr-to-z16-linuxone4-single-frame-and-rack-mount-models/ https://www.crowdstrike.com/blog/crowdstrike-brings-xdr-to-z... - https://access.redhat.com/solutions/7068083 https://access.redhat.com/solutions/7068083
      - fuzzfactor 2y ago
        smh, big iron is in the crosshairs and Linux to boot. Or maybe not to boot . . .
MyFedora 2y ago
> Why is this different? Because critical infrastructure doesn't get the convenience of shifting the blame. They must account for these risks in advance. Do you know what happens when IT breaks down in a bank? They've got two or more printers that print all new transactions. Database corruption? No problem, we've got the transactions right there. Printer breaks down? No problem, we've got another one printing the transactions right there. Hospitals don't get the luxury of shifting the cause of death from them failing to properly account for risks to a piece of software.
- anonzzzies 2y ago
  I think they need to do both. But then again, I don't think most of the IT staff in these places are very capable. I have large hospitals as clients and everything is fairly terrible there (it is how I make most of my money; I solve these type of issues for companies when shit hits the fan and hospitals are kind of the worst, but banks or gov orgs are also not great). They don't understand any of this really so it's not weird that they buy stuff that's recommended in CIO magazine. But yes, they cannot shifting cause of death indeed.
- madeofpalk 2y ago
  Where is the line drawn on how much is the responsibility of the "end users" (hospitals, etc). Hypothetically, if there was a widespread 'bug' in... Intel CPUs that caused a similar issue, would you say it was the hospitals that should be held accountable, or Intel, or someone else? What about if the issue was in Windows itself - what should each hospital do differently that would have avoided this?
  - threatofrain 2y ago
    Let the consumers sue the hospitals and banks, and let those entities that directly interface with consumers sue Intel in return. Consumers need an interface to recover damages. This will provide the motivation not to keep around shit vendors and entertain shit contracts that basically absolve the vendors of all blame. When the damages are in the billions we need to make sure that there are billions in liability to balance the scales. Or else there will always be a perverse incentives to not give a shit.
threatofrain 2y ago
Hospitals bought into a contract where the terms basically said "don't rely on us for anything important, especially not anything that impacts human life". Patients were certainly medically impacted, perhaps up to the point of early death. Whose incompetence is that? If a hospital pays for an energy redundancy solution where the vendor basically communicates "please don't use us for anything important", and then a power outage costs lives, are we seriously saying that the hospital shouldn't have to pay big time? I'm not saying that CS shouldn't be liable. I'm saying that when consumers are looking for someone to sue, and regulators are looking for someone to punish, those who directly interface with the consumer should be in the direct line of fire. Hospitals in turn should be able to sue CS. We certainly should not prefer that the blame goes straight to the engineer as then the consumer would basically have nobody to sue. That's a world of even less accountability. Those who are most capable of taking responsibility should take responsibility, and not merely those who are most blameworthy from first principles of local causality. There could be billions of dollars of damage here. There must be billions in liability as well to balance the economic scales. This is way past the single individual who pulled the trigger.

Ekaros 2y ago

It is one thing if these updates were in hands of the IT of the companies, but that this company just could automatically push them over is just weird. I accept shared responsibility when there is some agreed deployment and such scenarios, but here? Nope it is on CrowdStrike...

prepend 2y ago
If you hand your car keys to a drunk driver, it’s on both of you. If I give root to a third party, then I’m liable for everything they do with that root.
- zakki 2y ago
  The guy was not drunk when the key was given.
  - prepend 2y ago
    I’ve seen crowdstrike’s process. Seems drunk to me.
- anonzzzies 2y ago
  If I hand over my car keys to the same cleaning companies every month and all is fine always, except this last time, the cleaner cuts the break lines while cleaning the under side and I die in a crash.
- Barrin92 2y ago
  That is a nonsensical comparison. Remote software updates and administration are common professional services that consumers of software cannot execute themselves. The correct comparison would be handing your house keys to a licensed insect exterminator and the guy accidentally poisoning your family. You of course are not liable if a professional supplying you with a service messes up.
  - prepend 2y ago
    Crowdstrike doesn’t test their releases. It’s like paying a licensed insect exterminator that uses random chemicals. They tell you this and you hand over the keys anyways.
- Ekaros 2y ago
  An other view. Tesla does over-the-air updated you don't verify. It disables break, you drive car and kill someone due to this. Do you share responsibility? What if this happens while driving?
MyFedora 2y ago
It was a virus definition update, not a software update. CrowdStrike will obviously update their virus definition deployment pre-flight check to prevent a situation like this from happening again, but a staged roll-out is out of the question. What do you want them to do? Expose everyone to new known viruses for longer?
- thunky 2y ago
  > CrowdStrike will obviously update their virus definition deployment pre-flight check to prevent a situation like this from happening again I don't consider them capable of preventing something like this from happening again.
  - anonzzzies 2y ago
    No worries, it will happen again. That’s why they need to be euthanised.
- pjmorris 2y ago
  > a staged roll-out is out of the question. What do you want them to do? Expose everyone to new known viruses for longer? I think trading, say, small x (15 minutes, an hour?) time, to stage rather than blast might be an acceptable tradeoff given the visible consequences of not doing so.

andyferris 2y ago

OTOH installing insecure/unstable “security additions” on top of windows should be consider a terrible idea (ie making a bad situation worse). Our essential services should be built on a more secure OS, if windows isn’t suitable.

thunky 2y ago
> OTOH installing insecure/unstable “security additions” on top of windows should be consider a terrible idea So it sounds like you agree that Crowdstrike should go bankrupt. > Our essential services should be built on a more secure OS, if windows isn’t suitable Oh wait you blame Windows for this?
- fuzzfactor 2y ago
  When an IBM mainframe was the routine system, well recognized as a single-point-of-failure, it wasn't a problem like this.
  - thunky 2y ago
    Hate to break it to you: - https://www.crowdstrike.com/blog/crowdstrike-brings-xdr-to-z16-linuxone4-single-frame-and-rack-mount-models/ https://www.crowdstrike.com/blog/crowdstrike-brings-xdr-to-z... - https://access.redhat.com/solutions/7068083 https://access.redhat.com/solutions/7068083
    - fuzzfactor 2y ago
      smh, big iron is in the crosshairs and Linux to boot. Or maybe not to boot . . .

MyFedora 2y ago

> Why is this different? Because critical infrastructure doesn't get the convenience of shifting the blame. They must account for these risks in advance. Do you know what happens when IT breaks down in a bank? They've got two or more printers that print all new transactions. Database corruption? No problem, we've got the transactions right there. Printer breaks down? No problem, we've got another one printing the transactions right there. Hospitals don't get the luxury of shifting the cause of death from them failing to properly account for risks to a piece of software.

anonzzzies 2y ago
I think they need to do both. But then again, I don't think most of the IT staff in these places are very capable. I have large hospitals as clients and everything is fairly terrible there (it is how I make most of my money; I solve these type of issues for companies when shit hits the fan and hospitals are kind of the worst, but banks or gov orgs are also not great). They don't understand any of this really so it's not weird that they buy stuff that's recommended in CIO magazine. But yes, they cannot shifting cause of death indeed.
madeofpalk 2y ago
Where is the line drawn on how much is the responsibility of the "end users" (hospitals, etc). Hypothetically, if there was a widespread 'bug' in... Intel CPUs that caused a similar issue, would you say it was the hospitals that should be held accountable, or Intel, or someone else? What about if the issue was in Windows itself - what should each hospital do differently that would have avoided this?
- threatofrain 2y ago
  Let the consumers sue the hospitals and banks, and let those entities that directly interface with consumers sue Intel in return. Consumers need an interface to recover damages. This will provide the motivation not to keep around shit vendors and entertain shit contracts that basically absolve the vendors of all blame. When the damages are in the billions we need to make sure that there are billions in liability to balance the scales. Or else there will always be a perverse incentives to not give a shit.

threatofrain 2y ago

Hospitals bought into a contract where the terms basically said "don't rely on us for anything important, especially not anything that impacts human life". Patients were certainly medically impacted, perhaps up to the point of early death. Whose incompetence is that? If a hospital pays for an energy redundancy solution where the vendor basically communicates "please don't use us for anything important", and then a power outage costs lives, are we seriously saying that the hospital shouldn't have to pay big time? I'm not saying that CS shouldn't be liable. I'm saying that when consumers are looking for someone to sue, and regulators are looking for someone to punish, those who directly interface with the consumer should be in the direct line of fire. Hospitals in turn should be able to sue CS. We certainly should not prefer that the blame goes straight to the engineer as then the consumer would basically have nobody to sue. That's a world of even less accountability. Those who are most capable of taking responsibility should take responsibility, and not merely those who are most blameworthy from first principles of local causality. There could be billions of dollars of damage here. There must be billions in liability as well to balance the economic scales. This is way past the single individual who pulled the trigger.