Hacker News new | ask | show | jobs
by jgeada 693 days ago
WTF? Isn't that exactly the one of the main jobs of the OS, to not crash regardless of what user-space software is doing?
5 comments

Endpoint protection is hardly user-space software. It gets deeply privileged access to the entire system.
There's also the argument that a business OS that you spend thousands or pay a monthly licensing fee for should be hardened enough already to not need software like Crowdstrike. But I'm also completely ignorant to what it actually does and how critical it is.

I used to be a Windows Engineer in webhosting (RAX, Hostgator, 2-3 others) I assume before this software existed and I had to hand-craft an insane amount of security services in posh and python. When I first got into Windows syseng stuff, I think IIS5 so win2k IIRC, IIS didn't have something as simple as URL Rewrite abilities. You had to buy a 3rd party package for EACH server at $25 or write one, I had thousands of servers. Zero thought about people actually using IIS for webhosting. I had to make my own brute force detection service that continuously monitored eventviewer for an RDP permission denied error code, then write that IP to the windows firewall. All this stuff is an apt-get away in lunix. Windows Server is so shockingly barebones and to be quite frank most Windows syseng people aren't the best engineers and wouldn't think to make almost any of this. On many of my teams I was the only one who could program.

We'd put servers up without a firewall and post their IPs on irc and see how long it took someone to pop one, if they didn't get popped before we got back to our NOC.

I dealt with that OS from sysadmin 1-3 over 10 years I am so goddamned happy everything is an ephemeral linux container now.

I think the idea is that CrowdStrike doesn’t run in user space.

If an Nvidia driver had bricked the machines, would that be MS fault or Nvidia fault?

IME a graphics driver crash recovers just fine on Windows. The screen goes black for half a second and you're back in business without losing progress.
I've had NVidia drivers bluescreen Windows 10 and 11 machines within the past six months.
Why not both? I am perfectly happy to blame multiple parties, not just one.
It wasn't user space, it installs a kernel mode driver
it was a kernel mode driver.