3 ms·

Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Maybe now ClownStrike will start testing it properly, hopefully there

Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Maybe now ClownStrike will start testing it properly, hopefully thereby fixing the stability and other issues.

vladvasiliu 2y ago
Likely not by the people who make the decisions to purchase this. They're usually hearing more from the marketing/sales people than from those actually having to deal with this. Personally, I don't expect this to make much of a difference, if any.
- justinclift 2y ago
  > Personally, I don't expect this to make much of a difference, if any. While you're probably right, I'm hoping ClownStrike's court results so absolutely dwarf their insurance coverage that it's nearly company ending. ie something to actually get them to improve things, not just generate empty PR platitudes: https://www.youtube.com/watch?v=SiL2AjOtjZI https://www.youtube.com/watch?v=SiL2AjOtjZI
  - vladvasiliu 2y ago
    Meh. We (techies) always knew the risks of running random crap in kernel space, especially when it runs junk it downloads from the internet. So, I expect this to be spun somehow along the lines of "sure all our boxes were down, but look, you've brought them all back up, didn't you? Now think about all the bad guys this protects us against! Of course the risk was worth it!". Also, "everybody does this! we couldn't have known!" "security people" are scared shitless of the whole "the world is ending! there are threats everywhere!" discourse that vendors peddle. The less technical, the more scared they are. Many of these people don't really understand what they're talking about and what compromises their decisions actually imply. Losing a day of work is simply dwarfed by "all your data is gone!".
    - davidmurdoch 2y ago
      I like to poke the security bears at my company by suggesting that the security team is actually a double agent team whose real employer is our competitor. They never find it funny for some reason.
GoToRO 2y ago
The problem is that you think that those managers are nice and reasonable people like yourself. They are not. What will happen is that some manager will yell at some other manager that will yell at some other manager that will yell at some tester that works on the cheapest virtual machine possible, on which it takes 5 minutes to log in and it disconnects after 2 minutes of idle. All the while, not changing anything. I'm pretty sure that all their resources are allocated to lawyers right now and their managers try really hard to gaslight their customers by telling them it was not that bad, they came up with the fix really fast (ignoring the fact that the fix was not possible to be applied) and so on.
- blibble 2y ago
  hopefully the lawyers are demanding payment in advance in many countries there are very strict limits on excluding liability for negligence
anonzzzies 2y ago
It's CIO magazine snakeoil. You don't buy it for any other reason than tick off some risk thing without knowing/thinking about it. Everyone does it, so he. Terrible.
ykonstant 2y ago
> Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Right, but other commenters call it the best EDR out there; so it is really hard for those of us outside the loop to understand what the hell is going on. Is CS, or any other EDR, actually preventing attacks that would pass through if absent? To what extent? Where are the numbers? Who audits CS code? I have seen no real data, only assertions.
- justinclift 2y ago
  Yeah, I'm as surprised as you that people have been saying ClownStrike Falcon was good. I guess the people saying that are security folk who look at things from a high level place of some sort (?). Because they don't seem aware of (or don't care about) the many problems it causes on the servers it gets deployed to. As we've now had amply demonstrated. Globally. ;)

Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Maybe now ClownStrike will start testing it properly, hopefully thereby fixing the stability and other issues.

vladvasiliu 2y ago

Likely not by the people who make the decisions to purchase this. They're usually hearing more from the marketing/sales people than from those actually having to deal with this. Personally, I don't expect this to make much of a difference, if any.

justinclift 2y ago
> Personally, I don't expect this to make much of a difference, if any. While you're probably right, I'm hoping ClownStrike's court results so absolutely dwarf their insurance coverage that it's nearly company ending. ie something to actually get them to improve things, not just generate empty PR platitudes: https://www.youtube.com/watch?v=SiL2AjOtjZI https://www.youtube.com/watch?v=SiL2AjOtjZI
- vladvasiliu 2y ago
  Meh. We (techies) always knew the risks of running random crap in kernel space, especially when it runs junk it downloads from the internet. So, I expect this to be spun somehow along the lines of "sure all our boxes were down, but look, you've brought them all back up, didn't you? Now think about all the bad guys this protects us against! Of course the risk was worth it!". Also, "everybody does this! we couldn't have known!" "security people" are scared shitless of the whole "the world is ending! there are threats everywhere!" discourse that vendors peddle. The less technical, the more scared they are. Many of these people don't really understand what they're talking about and what compromises their decisions actually imply. Losing a day of work is simply dwarfed by "all your data is gone!".
  - davidmurdoch 2y ago
    I like to poke the security bears at my company by suggesting that the security team is actually a double agent team whose real employer is our competitor. They never find it funny for some reason.

GoToRO 2y ago

The problem is that you think that those managers are nice and reasonable people like yourself. They are not. What will happen is that some manager will yell at some other manager that will yell at some other manager that will yell at some tester that works on the cheapest virtual machine possible, on which it takes 5 minutes to log in and it disconnects after 2 minutes of idle. All the while, not changing anything. I'm pretty sure that all their resources are allocated to lawyers right now and their managers try really hard to gaslight their customers by telling them it was not that bad, they came up with the fix really fast (ignoring the fact that the fix was not possible to be applied) and so on.

blibble 2y ago
hopefully the lawyers are demanding payment in advance in many countries there are very strict limits on excluding liability for negligence

anonzzzies 2y ago

It's CIO magazine snakeoil. You don't buy it for any other reason than tick off some risk thing without knowing/thinking about it. Everyone does it, so he. Terrible.

ykonstant 2y ago

> Awesome. Falcon has been widely known (for years) as an utter piece of shit (code wise). Right, but other commenters call it the best EDR out there; so it is really hard for those of us outside the loop to understand what the hell is going on. Is CS, or any other EDR, actually preventing attacks that would pass through if absent? To what extent? Where are the numbers? Who audits CS code? I have seen no real data, only assertions.

justinclift 2y ago
Yeah, I'm as surprised as you that people have been saying ClownStrike Falcon was good. I guess the people saying that are security folk who look at things from a high level place of some sort (?). Because they don't seem aware of (or don't care about) the many problems it causes on the servers it gets deployed to. As we've now had amply demonstrated. Globally. ;)