Hacker News Reader

Comment by TillE | Hacker News Reader

That probably explains how it got past internal testing. Something went wrong after that, during deployment.

Someone on the Fediverse conjectured that it might have been down to the Azure glitch earlier in the day. An empty file would fit that if they weren't doing proper error checking on their downloads, etc.

It's crazy if they weren't signing and verifying downloads

https://news.ycombinator.com/item?id=41006104#41006555

the flawed data was added in a post-processing step of the configuration update, which is after it's been tested internally but before it's copied to their update servers

It's still crazy that a security tool does not validate content files it loads from disk that get regularly updated. Clearly fuzzing was not a priority either.

How many years has this Crowdstrike code been running without issues? You have put your finger on it: Fuzzing should have been part of a test plan. Even TDD isn't a bastard test engineer writing tests that probe edge cases. Even observing that your unit tests have good code coverage isn't a substitute for fuzzing. There is even a counter-argument that something that been reliable in the field should not be fixed for reasons like failing a test case never seen in real deployments, so why go making trouble.

It could be as simple as cosmic radiation that flipped a bit (it has happened before: https://www.independent.co.uk/news/science/subatomic-particl...), or as sophisticated as an adversarial hacking.

The same cosmic radiation that flips the bits to make some specific political party win.

I don't understand, how the signature even worked? Please please tell me those drivers are signed... Right? ...

Reply on news.ycombinator.com