Hacker News Reader

Comment by 0xcafecafe | Hacker News Reader

They could even have done slow rollouts. Roll it out to a geographical region and wait an hour or so before deploying elsewhere.

View on HN

In theory CrowdStrike protects you from threats, leaving regions unprotected for an hour would be an issue.

Not really, even for security updates are not needed by the minute. Do you think Microsoft rollout world wide updates to everyone?

This is definitely their sales pitch, and most orgs (evidently) don't follow the guidance of doing EDR rollouts in staging environments first. That being said, if your security posture is at the point where not getting the latest updates from CrowdStrike quick enough is why you're getting breached, you are frankly screwed already.

Or test in local environments first. Slow rollouts like this tend to make deployments very very painful.

Slow rollouts can be quite quick. We used to do 3-day rollouts. Day one was a tiny fraction. Day two was about 20%. Day three was a full rollout.

It was ages ago, but from what I remember, the first day rollout did occasionally catch issues. It only affected a small number of users and the risk was within the tolerance window.

We also tested locally before the first rollout.

I don't know about this particular update, but when I used to work for an AV vendor we did like 4 "data" updates a day. It is/was about being quick a lot of the time, you can't stage those over 3 days. Program updates are different, drivers of this level were very different (Microsoft had to sign those, among many things).

Not thay it exuces anything, just that this probably wasn't treated as an update at all.

You say even (emphasis mine). Is this not industry standard?

Reply on news.ycombinator.com