this post was submitted on 22 Jul 2024
258 points (97.8% liked)

Technology

58303 readers
17 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 157 points 4 months ago (11 children)

Personally, I don't see the issue. Microsoft shouldn't be responsible for when a third party creates a buggy kernel module.

And when you, as a company, decide to effectively install a low-level rootkit on all your machines in hopes that it will protect you against whatever, you accept the potential side effects. Last week, those side effects occurred.

[–] [email protected] 70 points 4 months ago (1 children)

Hard to say yet, if Microsoft is responsible or not. The thing is they certified it, as a stable and tested driver. But it isn't just a driver, but an interpreter/loader that loads code at runtime and executes it. In kernel mode. If Microsoft knew this they're definitely responsible for certifying it, but maybe crowdstrike hid this behavior until it was deployed to the customers.

[–] [email protected] 25 points 4 months ago (1 children)

It was my understanding that this wasn’t certified. Crowdstrike circumvented the signing process.

[–] [email protected] 43 points 4 months ago (2 children)

The driver was signed, the issue was with a configuration file for that's not part of the driver.

[–] cheddar 8 points 4 months ago* (last edited 4 months ago) (2 children)

A configuration file shouldn't crash the kernel. I don't understand how this solution could pass the certification. I don't know the criteria of course, but on the surface it sounds like Crowdstrike created a workaround, and Microsoft either missed or allowed it.

[–] [email protected] 6 points 4 months ago (3 children)

How would you prove that no input exists that could crash a piece of code? The potential search space is enormous. Microsoft can't prevent drivers from accepting external input, so there's always a risk that something could trigger an undetected error in the code. Microsoft certainly ought to be fuzz testing drivers it certifies but that will only catch low hanging fruit. Unless they can see the source code, it's hard to determine for sure that there are no memory safety bugs.

The driver developers are the ones with the source code and should have been using analysis tools to find these kinds of memory safety errors. Or they could have written it in a memory safe language like Rust.

load more comments (3 replies)
[–] [email protected] 5 points 4 months ago

AFAIK, blue screen doesn't mean kernel crash. Hell, windows crashing isn't even rare.

Certification doesn't mean it has Microsoft seal of approval either, only that it comes from a certified and approved vendor, with some checks at best.

Config files are not part of the driver, ever. How do you think you can change the settings of you GPU without asking Microsoft?

But hey, if you are so willing to blame Microsoft for the one time it's not their fault, may I talk to you about our Lord Savior Linux? In my office we only knew because of the memes.

load more comments (1 replies)
load more comments (10 replies)
[–] [email protected] 100 points 4 months ago (2 children)

Oh FFS. I love this era where companies will not accept the blame due to "liability", even when they are explicitly to blame.

[–] [email protected] 76 points 4 months ago* (last edited 4 months ago) (29 children)

We all hate Microsoft for turning Windows into an ad platform but they aren't wrong.

They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer. Because anything else means Microsoft is in control and not the software you installed.

It's no different than Linux in that way. If you install a buggy device driver on Linux, that's your/the driver's fault, not Linux.

[–] [email protected] 56 points 4 months ago* (last edited 4 months ago)

You are not wrong, but people don't want to hear it. Do we want to retain control over what goes into kernel space or not? If so, we have to accept that whatever we stuff in there can crash the entire thing. That's why we have stuff like driver signatures. Which Crowdstrike apparently bypassed with a technical loophole from how I understand it.

load more comments (28 replies)
[–] [email protected] 35 points 4 months ago (1 children)

Fuck Microsoft and fuck Windows.

But if you inject hacky bullshit third party code into someone's OS that breaks things, it's not the OS's fault.

[–] [email protected] 5 points 4 months ago (1 children)

But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn't have certified it because they can not fully test it. If they didn't know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn't certify it, they would have had zero fault.

[–] [email protected] 10 points 4 months ago (4 children)

Certifying a driver is not an endorsement.

It is a verification that it is legitimately from who it claims to be from. Microsoft has zero fault, period.

[–] [email protected] 4 points 4 months ago (2 children)

The Windows Hardware Certification program (formerly Windows Hardware Quality Labs Testing, WHQL Testing, or Windows Logo Testing) is Microsoft's testing process which involves running a series of tests on third-party device drivers, and then submitting the log files from these tests to Microsoft for review. The procedure may also include Microsoft running their own tests on a wide range of equipment, such as different hardware and different Microsoft Windows editions.

[–] [email protected] 6 points 4 months ago* (last edited 4 months ago)

For the Nth time, crowdstrike circumvented the testing process

Edit: this is not to say that cs didn’t have to in order to provide their services, nor is this to say that ms didn’t know about the circumvention and/or delegate testing of config files to CS. I’ll take any opportunity to rag on MS, but in this case it is entirely on CS.

load more comments (1 replies)
load more comments (3 replies)
[–] [email protected] 90 points 4 months ago* (last edited 4 months ago)

I'm sorry, but competition is good.

Installing some closed blob into your kernel, that's on you.

The problem is if anything is not enough competition. We just saw a centralized monoculture fall over.

[–] [email protected] 62 points 4 months ago (3 children)

This whole thing just exposes that people getting paid big bucks for this shit, aint really that smart or planning for anything, they are just collecting rent until something blows up lol

[–] [email protected] 6 points 4 months ago (1 children)

They just pay so when it goes sideways they can hold up their hands and point out a reputable supplier was used and now it's not their problem or blemish on their career.

load more comments (1 replies)
load more comments (2 replies)
[–] [email protected] 40 points 4 months ago (1 children)

Blaming the EU is stupid MacOS is locked down, for the EU it’s more about apps less about the kernel space.

[–] [email protected] 15 points 4 months ago (1 children)

Security software are also "apps". Since Microsoft is also in the security software business locking down access for their competitors could definitely be seen as anti-competitive practices.

Apple doesn't have a monopoly with MacOS so other rules apply.

load more comments (1 replies)
[–] [email protected] 39 points 4 months ago (2 children)

Meanwhile a Microsoft employee on how to prevent such an issue under Linux: https://www.phoronix.com/news/systemd-Auto-Boot-Assessment

[–] [email protected] 6 points 4 months ago (1 children)

a Microsoft employee

You're talking about good ol' Lenny like he isn't the author of the most used init and utility system as well as PulseAudio.

[–] [email protected] 5 points 4 months ago (1 children)

I know who that is and he's also a Microsoft employee these days which makes this a funny sequence of statements:

"EU bad because they made us open up Windows to 3rd party anti-virus vendors. Oh, btw, the fully open Linux operating system can cope with such a problem if properly configured. Here's the documentation to make that configuration."

load more comments (1 replies)
[–] [email protected] 5 points 4 months ago (3 children)

I don't know enough about Windows 10/11, but aren't they supposed to boot into a menu thet allows you to pick the last known good configuration before it evens boots to the gui?

[–] [email protected] 8 points 4 months ago

The problem is with a specific file on the disk, not a misconfiguration

[–] jonc211 7 points 4 months ago (1 children)

Apparently it’s because CrowdStrike installed their device driver as one that must start when Windows starts.

Explained here: https://youtu.be/wAzEJxOo1ts?feature=shared&t=675

I’ve linked to the specific time where he explains that issue, but tbh the whole video is worth watching.

load more comments (1 replies)
[–] [email protected] 6 points 4 months ago (2 children)

It's been a while since I had such a massive problem under Windows but the last time you could try to restore one of the last backups and usually that failed because Windows restore points are/were crap.

load more comments (2 replies)
[–] [email protected] 24 points 4 months ago

The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers.

The document does not, however say those APIs have to exist. Microsoft could eliminate them for its own security products and then there would be no issue.

[–] [email protected] 8 points 4 months ago (3 children)

even when it was the bears I knew it was regulation and taxes.

load more comments (3 replies)
load more comments
view more: next ›