[plorkyeran]

With a title like "What everyone seems to be missing about ..." I was sort of expecting something other than a repeat of some of the most common comments made about it. "Why didn't they do a staggered rollout?" is literally the first thing that anyone with any sort of IT experience asks.

[NoPicklez]

Myself included, I thought perhaps I had missed something important but it was what most other people were asking

[sshine]

I didn’t even bother to read the article; I went straight to the comment section to see why the author is wrong!

[svantex]

It is kind of obvious, isn't it? But I've yet to see any hard questions asked in main stream media about the process of simultaneous global rollout of "content updates".

But in a recent update of https://www.crowdstrike.com/falcon-content-update-remediatio... they have a long explanation of of things are supposed to work, with a lot of nice words (sounds almost AI-written...) and quite a few implications that it's really the customers fault who have not configured their systems to for example stay one version behind the latest and still a very short explanation of what went wrong.

But... Lo and behold, what are CrowdStrike going to do to avoid this happening in the future?

"Implement a staggered deployment strategy for Rapid Response Content in which updates are gradually deployed to larger portions of the sensor base, starting with a canary deployment." About time...

My main point, and the reason for the title, is that this has not been the major takeaway in main stream media analyses. Of course not "everyone" has missed this, but pretty much all media articles about the incident do appear to miss this.

[NoPicklez]

Mainstream media are unlikely to report into such detail, they would often ask questions such as "How could such an update cause a global outage?" or "How could this be allowed to happen".

Most people didn't even know what Crowdstrike was, let alone understand the concept of testing updates and staggering them.

Lastly, the media are at risk of reporting the wrong thing and being a target of litigation. Therefore they report often in hyperbole and without much factual information until the facts are determined.

[ssahoo]

My biggest concern is that how they missed to test the kernel code to run without a failover mechanism to last known configuration? It's common sense. Their QA never raised this concern for availability?