4 ms·

How would that have helped the server farms that were experiencing the issue?

gjsman-1000 2y ago
Oh I don’t know, the servers down, you go and look as a technician, and you simply see a screen saying: “CSAgent.sys has caused a failure to boot three times in a row. Do you want to disable this driver? <Yes> <No>.” You click “Yes.” Server reboots with CloudStrike driver disabled. The day is saved in 5 minutes instead of building a custom ISO image or going on a BitLocker key recovery spree.
- politelemon 2y ago
  It would still have required on site presence and interaction during which there is still downtime, so this accomplishes marginally small gains.
  - gjsman-1000 2y ago
    At the same time though, imagine you woke up and CloudStrike hit your organization. For most users, they’ll try clicking “Yes.” And then it’s back to work. After all, “No” just causes a blue screen again, might as well try the other path. This would have been the difference between the IT department handling 10,000+ calls or a few hundred (plus sending out a bulletin) in many, many organizations. It also could have saved billions at this point. Heck, it would have saved lives in hospitals.
    - jonathantf2 2y ago
      But then you have millions of endpoints booting without malware protection
    - echoangle 2y ago
      Can you cite some reports of deaths caused by the outage?
deleted 2y ago
[deleted]
morkalork 2y ago
Instead of prompting on the screen, disable the driver and boot directly into a recovery state that has networking enabled so sysadmins can push scripts and fixes? As long as it's not a network driver you'd be okay.
- t-writescode 2y ago
  Disable the driver that is explicitly there to protect from malware and attacks? Wouldn’t malware just use that as an attack vector?
  - morkalork 2y ago
    >Nooo you don't understaaaand kernel code is special :'( actually BSOD was a desired feature because CrowdStrike is a Security (TM) application

Oh I don’t know, the servers down, you go and look as a technician, and you simply see a screen saying: “CSAgent.sys has caused a failure to boot three times in a row. Do you want to disable this driver? <Yes> <No>.” You click “Yes.” Server reboots with CloudStrike driver disabled. The day is saved in 5 minutes instead of building a custom ISO image or going on a BitLocker key recovery spree.

politelemon 2y ago
It would still have required on site presence and interaction during which there is still downtime, so this accomplishes marginally small gains.
- gjsman-1000 2y ago
  At the same time though, imagine you woke up and CloudStrike hit your organization. For most users, they’ll try clicking “Yes.” And then it’s back to work. After all, “No” just causes a blue screen again, might as well try the other path. This would have been the difference between the IT department handling 10,000+ calls or a few hundred (plus sending out a bulletin) in many, many organizations. It also could have saved billions at this point. Heck, it would have saved lives in hospitals.
  - jonathantf2 2y ago
    But then you have millions of endpoints booting without malware protection
  - echoangle 2y ago
    Can you cite some reports of deaths caused by the outage?

deleted 2y ago

[deleted]

morkalork 2y ago

Instead of prompting on the screen, disable the driver and boot directly into a recovery state that has networking enabled so sysadmins can push scripts and fixes? As long as it's not a network driver you'd be okay.

t-writescode 2y ago
Disable the driver that is explicitly there to protect from malware and attacks? Wouldn’t malware just use that as an attack vector?
- morkalork 2y ago
  >Nooo you don't understaaaand kernel code is special :'( actually BSOD was a desired feature because CrowdStrike is a Security (TM) application