• apfelwoiSchoppen@lemmy.world
    link
    fedilink
    English
    arrow-up
    91
    arrow-down
    10
    ·
    4 months ago

    Oh FFS. I love this era where companies will not accept the blame due to “liability”, even when they are explicitly to blame.

    • Blue_Morpho@lemmy.world
      link
      fedilink
      English
      arrow-up
      81
      arrow-down
      12
      ·
      edit-2
      4 months ago

      We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

      They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer. Because anything else means Microsoft is in control and not the software you installed.

      It’s no different than Linux in that way. If you install a buggy device driver on Linux, that’s your/the driver’s fault, not Linux.

      • umami_wasabi@lemmy.ml
        link
        fedilink
        English
        arrow-up
        3
        ·
        4 months ago

        But what if Windows have something similar to eBPF in Linux, and CS opted to use it, will this disaster won’t happen at all or in a much smaller scale and less impactful?

      • kescusay@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        9
        ·
        edit-2
        4 months ago

        The thing is, Microsoft’s virus-scanning API shouldn’t be able to BSOD anything, no matter what third-party software makes calls to it, or the nature of those calls. They should have implemented some kind of error handler for when the calls are malformed.

        So this is really a case of both Crowdstrike and Microsoft fucking up. Crowdstrike shoulders most of the blame, of course, but Microsoft really needs to harden their API to appropriately catch errors, or this will happen again.

        I’m an idiot. For some reason, I was thinking about the Windows Defender API, which can be called from third-party applications.

        • Heavybell@lemmy.world
          link
          fedilink
          English
          arrow-up
          11
          ·
          4 months ago

          I don’t believe there was any specific API in use here, for virus scanning or not. I suppose maybe the device driver API? I am not a kernel developer so I don’t know if that’s the right term for it.

          Crowdstrike’s driver was loaded at boot and caused a null pointer dereference error, inside the kernel. In userspace, when this happens, the kernel is there to catch it so only the application that caused it crashes. In kernelspace, you get a BSOD because there’s really nothing else to do.

          https://youtube.com/watch?v=wAzEJxOo1ts

          • kescusay@lemmy.world
            link
            fedilink
            English
            arrow-up
            5
            ·
            4 months ago

            I stand corrected. For some reason, I was thinking they used the actual Windows Defender API, which can be called programmatically from third-party applications, but you’re correct, it was a driver loaded at boot. Microsoft isn’t at all at fault, here.

          • kescusay@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            4 months ago

            Nope. It’s a lower level kernel API that has to be accessed at boot via a driver. The API I was thinking of - and I use the term “thinking” loosely, here - is an API that userspace applications can take advantage of to scan files after boot is already complete.

      • NeoNachtwaechter@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        arrow-down
        13
        ·
        edit-2
        4 months ago

        They are legally required to let Crowdstrike crash your computer.

        I call Bullshit.

        If it had been Windows NT 3.5, there would have been no bluescreens around the world. It would have stopped the buggy software, given a message accordingly, and continued it’s job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.

        Now you tell me that Windows NT 3.5 is illegal?

            • MinFapper@startrek.website
              link
              fedilink
              English
              arrow-up
              4
              ·
              4 months ago

              A better comparison would be an iPhone. Apple has locked that down so much that it’s impossible to install something like CrowdStrike falcon, thus it’s not possible for something like this to happen.

              Microsoft is saying if the EU would let them, they too could lock down their platform enough to prevent this from happening.

              However, I would prefer to maintain control over my device and do what I want with it, instead of just what Apple/Microsoft want; even if that means I might break my device.

            • Blue_Morpho@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              ·
              4 months ago

              Not then, but European anti trust lawsuits resulted in laws that require Microsoft to allow 3rd parties complete access. That means if the 3rd party software is a low level driver, it will crash the system. They are legally required to allow vendors the level of access that can crash the system.

            • BearOfaTime@lemm.ee
              link
              fedilink
              English
              arrow-up
              3
              ·
              4 months ago

              They were legally required to permit third party to install a kernel mode driver.

      • 0x0@programming.dev
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        10
        ·
        4 months ago

        Yeah I saw the article that says they’re legally required but until I can actually read that document where it says “thou shall give everyone ring-0” access I’m gonna call it bullshit.

            • OfCourseNot@fedia.io
              link
              fedilink
              arrow-up
              6
              ·
              4 months ago

              It might not be written literally like that but for Microsoft not letting third party developers write kernel drivers for windows would be considered abusing their position in the market very fast. The problem isn’t they allow kernel drivers, this is just ms throwing all the balls they can, is that they certified this very driver, as tested and stable. Without this certification most IT teams would’ve been more reticent to install crowdstrike’s root kit in their systems.

      • Cyth@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        20
        ·
        4 months ago

        I actually agree, I own my computer / OS and I should be able to do what you’re saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.

        • Feyd@programming.dev
          link
          fedilink
          English
          arrow-up
          11
          ·
          4 months ago

          That doesn’t make any sense. How does arguing against your position do anything but harm it?

          Maybe just give them grief over the myriad negative things they do that don’t counter your position?

    • conciselyverbose@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      31
      ·
      4 months ago

      Fuck Microsoft and fuck Windows.

      But if you inject hacky bullshit third party code into someone’s OS that breaks things, it’s not the OS’s fault.

      • kureta@lemmy.ml
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        2
        ·
        4 months ago

        But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn’t have certified it because they can not fully test it. If they didn’t know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn’t certify it, they would have had zero fault.

        • conciselyverbose@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          9
          arrow-down
          2
          ·
          4 months ago

          Certifying a driver is not an endorsement.

          It is a verification that it is legitimately from who it claims to be from. Microsoft has zero fault, period.

          • kureta@lemmy.ml
            link
            fedilink
            English
            arrow-up
            7
            arrow-down
            3
            ·
            4 months ago

            The Windows Hardware Certification program (formerly Windows Hardware Quality Labs Testing, WHQL Testing, or Windows Logo Testing) is Microsoft’s testing process which involves running a series of tests on third-party device drivers, and then submitting the log files from these tests to Microsoft for review. The procedure may also include Microsoft running their own tests on a wide range of equipment, such as different hardware and different Microsoft Windows editions.

            • sandalbucket@lemmy.world
              link
              fedilink
              English
              arrow-up
              7
              arrow-down
              1
              ·
              edit-2
              4 months ago

              For the Nth time, crowdstrike circumvented the testing process

              Edit: this is not to say that cs didn’t have to in order to provide their services, nor is this to say that ms didn’t know about the circumvention and/or delegate testing of config files to CS. I’ll take any opportunity to rag on MS, but in this case it is entirely on CS.

          • umami_wasabi@lemmy.ml
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            4 months ago

            I had a read about the WHQL (which I assumes what certified means). It uses the Windows HLK to perform a series of tests, which submited to Microsoft, and only then the driver will be signed.

            While certification isn’t endorsement, the testing and the resulting certification implies basic compatibility and reliability. And causing bootloops and BSODs is anywhere but close to “basic compatibility and reliability.”

            • punkfungus@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              6
              ·
              4 months ago

              Crowdstrike bypassed WHQL because the update was not to the driver, it was to a configuration file that then gets ingested by the driver. It’s deliberate so they can push out updates for developing threats without being slowed down by the WHQL process.

              And that means when they decide to just send it on a Friday with a buggy config file, nobody is responsible but Crowdstrike.

  • jabjoe@feddit.uk
    link
    fedilink
    English
    arrow-up
    80
    ·
    edit-2
    4 months ago

    I’m sorry, but competition is good.

    Installing some closed blob into your kernel, that’s on you.

    The problem is if anything is not enough competition. We just saw a centralized monoculture fall over.

  • sunzu@kbin.run
    link
    fedilink
    arrow-up
    62
    arrow-down
    4
    ·
    4 months ago

    This whole thing just exposes that people getting paid big bucks for this shit, aint really that smart or planning for anything, they are just collecting rent until something blows up lol

    • SlopppyEngineer@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      4 months ago

      They just pay so when it goes sideways they can hold up their hands and point out a reputable supplier was used and now it’s not their problem or blemish on their career.

      • rottingleaf@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        4 months ago

        Yes, an anarchist guy pointed this out to me that in our world responsibility can be delegated via contract while this doesn’t make any sense. The responsible person should still be responsible, only the specific action would be choosing those to whom to delegate the obligation for which they are responsible.

        Like in Nazi Germany and other fascist states they like to emotionally make only the leaders responsible, while with corps they like to only make the last company in chain responsible.

        In fact all chain is responsible. Responsibility is fully contagious.

        If this was like this in all laws, we’d have a much better world.

    • kevindqc@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      edit-2
      4 months ago

      I wouldn’t be surprised if the people finding viruses/malwares and detecting them aren’t the same people responsible for deployment. And anyway, it’s not like smart people make zero mistakes…

      • sunzu@kbin.run
        link
        fedilink
        arrow-up
        2
        ·
        4 months ago

        I always wonder about that and also all these data “breaches”

        Seems like a great way to retire early lol

        Economic incentive is there but at least we know that people are honest!

    • Lucy :3@feddit.org
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      1
      ·
      4 months ago

      a Microsoft employee

      You’re talking about good ol’ Lenny like he isn’t the author of the most used init and utility system as well as PulseAudio.

      • woelkchen@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        4 months ago

        I know who that is and he’s also a Microsoft employee these days which makes this a funny sequence of statements:

        “EU bad because they made us open up Windows to 3rd party anti-virus vendors. Oh, btw, the fully open Linux operating system can cope with such a problem if properly configured. Here’s the documentation to make that configuration.”

        • Lucy :3@feddit.org
          link
          fedilink
          English
          arrow-up
          4
          ·
          4 months ago

          Not only that, he specifically attacked “commercial operating systems” - it’s anyone’s guess which he meant - for not implementing it.

    • 800XL@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      4 months ago

      I don’t know enough about Windows 10/11, but aren’t they supposed to boot into a menu thet allows you to pick the last known good configuration before it evens boots to the gui?

  • Zak@lemmy.world
    link
    fedilink
    English
    arrow-up
    24
    arrow-down
    4
    ·
    4 months ago

    The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers.

    The document does not, however say those APIs have to exist. Microsoft could eliminate them for its own security products and then there would be no issue.

    • brianorca@lemmy.world
      link
      fedilink
      English
      arrow-up
      15
      ·
      4 months ago

      It’s a third party kernel module, which Microsoft would love to be able to block, but legally can’t. It’s technically possible to write a virus scanner that runs in user space instead of the kernel, but it’s easier to make sure everything gets scanned if it’s in the kernel.

  • 0x0@programming.dev
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    6
    ·
    edit-2
    4 months ago

    The document that outlines the agreement between Microsoft and the European Commission is available as a Doc file on Microsoft’s website.

    …which seems to be inaccessible. I highly doubt this document specifically said “giv’em ring-0 access”, this is just MS trying to deflect blame and cash it at the same time.