this post was submitted on 22 Jul 2024
45 points (95.9% liked)
Technology
59583 readers
3037 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Oh FFS. I love this era where companies will not accept the blame due to "liability", even when they are explicitly to blame.
Fuck Microsoft and fuck Windows.
But if you inject hacky bullshit third party code into someone's OS that breaks things, it's not the OS's fault.
But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn't have certified it because they can not fully test it. If they didn't know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn't certify it, they would have had zero fault.
Certifying a driver is not an endorsement.
It is a verification that it is legitimately from who it claims to be from. Microsoft has zero fault, period.
I had a read about the WHQL (which I assumes what certified means). It uses the Windows HLK to perform a series of tests, which submited to Microsoft, and only then the driver will be signed.
While certification isn't endorsement, the testing and the resulting certification implies basic compatibility and reliability. And causing bootloops and BSODs is anywhere but close to "basic compatibility and reliability."
Crowdstrike bypassed WHQL because the update was not to the driver, it was to a configuration file that then gets ingested by the driver. It's deliberate so they can push out updates for developing threats without being slowed down by the WHQL process.
And that means when they decide to just send it on a Friday with a buggy config file, nobody is responsible but Crowdstrike.
Oh wow. Then definitely CS is in fault. What a brilliant idea they have.
For the Nth time, crowdstrike circumvented the testing process
Edit: this is not to say that cs didn’t have to in order to provide their services, nor is this to say that ms didn’t know about the circumvention and/or delegate testing of config files to CS. I’ll take any opportunity to rag on MS, but in this case it is entirely on CS.
We all hate Microsoft for turning Windows into an ad platform but they aren't wrong.
They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer. Because anything else means Microsoft is in control and not the software you installed.
It's no different than Linux in that way. If you install a buggy device driver on Linux, that's your/the driver's fault, not Linux.
You are not wrong, but people don't want to hear it. Do we want to retain control over what goes into kernel space or not? If so, we have to accept that whatever we stuff in there can crash the entire thing. That's why we have stuff like driver signatures. Which Crowdstrike apparently bypassed with a technical loophole from how I understand it.
I call Bullshit.
If it had been Windows NT 3.5, there would have been no bluescreens around the world. It would have stopped the buggy software, given a message accordingly, and continued it's job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.
Now you tell me that Windows NT 3.5 is illegal?
You could absolutely install software on Windows 3.5 that would crash the system.
Can confirm. I've crashed most Microsoft products from msdos 5.
I ran 3.5. Yes, a network driver crash would blue screen NT3.5. Graphics were in user space in 3.5 so a video driver couldn't take NT 3.5 down but networking was in the kernel. https://en.m.wikipedia.org/wiki/Hybrid_kernel
OK, and... Were the legally required to make it crash?
A better comparison would be an iPhone. Apple has locked that down so much that it's impossible to install something like CrowdStrike falcon, thus it's not possible for something like this to happen.
Microsoft is saying if the EU would let them, they too could lock down their platform enough to prevent this from happening.
However, I would prefer to maintain control over my device and do what I want with it, instead of just what Apple/Microsoft want; even if that means I might break my device.
But what if Windows have something similar to eBPF in Linux, and CS opted to use it, will this disaster won't happen at all or in a much smaller scale and less impactful?
Crowdstrike managed to fuck up Linux through eBPF just as well.
https://access.redhat.com/solutions/7068083
If you load hacky shit into the kernel it can always find a way to make a nasty surprise. eBPF is a little bit better fence, not some miracle that automatically fixes shitty code.
🤦♂️
But these eBPF loader bugs are fixed now. Windows drivers are still causing BSODs and will continue to do so until Microsoft adopts eBPF.
Sorry, how is that related to the stability of the kernel?
I explained in my second sentence.
"They are legally required to give Crowdstrike or anyone low level access to the OS."
If you install a buggy driver into Linux and it crashes, that's not a problem with the Linux kernel.
https://www.redhat.com/sysadmin/linux-kernel-panic
I fully agree with you on that front, but ads have nothing to do with kernel access, so how is that relevant to their legal requirements?
I was explaining why everyone hates on Microsoft but the Crowdstrike crash had nothing to do with the reasons people hate MS.
Yeah I saw the article that says they're legally required but until I can actually read that document where it says "thou shall give everyone ring-0" access I'm gonna call it bullshit.
If it's not ring 0, it's not full access. They are legally required to give full access.
I'll believe it when I read it.
It might not be written literally like that but for Microsoft not letting third party developers write kernel drivers for windows would be considered abusing their position in the market very fast. The problem isn't they allow kernel drivers, this is just ms throwing all the balls they can, is that they certified this very driver, as tested and stable. Without this certification most IT teams would've been more reticent to install crowdstrike's root kit in their systems.
I actually agree, I own my computer / OS and I should be able to do what you're saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.
You are going to give grief to Microsoft for allowing what you want?
???
That doesn't make any sense. How does arguing against your position do anything but harm it?
Maybe just give them grief over the myriad negative things they do that don't counter your position?