Hacker News Reader

Also ironic that the compliance ended up introducing the biggest vulnerability as a massive single point of failure.

But that's government regulation for you.

pci-dss is not a government agency but it might as well be; it's a collusion between visa, mastercard, american express, discover, and jcb to prevent them from having different data security standards (and therefore being able to compete on security)

You mean “and therefore requiring businesses that take credit cards to enforce the union of all the restrictions imposed by all six companies (which might not even be possible—the restrictions might be contradictory) in order to accept all six types of cards”

you could imagine that if visa and mastercard had incompatible restrictions, such that merchants had to choose which one to accept, people would gradually shift to the card that got their money stolen less often, or whose (merchants') websites worked more reliably

since, instead, every business that uses credit cards at all is required to use the same set of counterproductive 'security' policies that make them more vulnerable than before, there is no way for market reality to ground these 'security' policies in real-world security. that's exactly the same problem that happens with government regulation

I've seen several merchants stop using amex because of restrictions. Admittedly those restrictions were very much in the form of excessive fees and nobody would have cared about their customer's stolen money.

Anyway, there isn't total solidarity within the credit card cartel.

The thing is that even today, where it's "easy", still nearly nobody is writing code to directly support the six different credit card types. Instead, businesses mostly rely on payment processors.

In a world where it's impossible to support all six card types directly with one codebase, one of the key dimensions on which payment processors would compete for mindshare, would be abstracting away those difficulties in supporting all six card types, enabling the business that uses them to accept more cards, more easily, than if the business went with some rival payment-processor. This would be a headline feature, however hard it is for them to accomplish internally.

The only difference from today, would be that now, due to those potentially-conflicting requirements, the payment processors would have to build six entirely-distinct payment backends that don't share a data model. (Basically treating each credit card platform's cards as different "payment rails", as distinctive from one-another as credit card payment rails today are from debit card payment rails.)

And then, of course, the payment processors themselves would come up with guidelines for handling those six different data warehouses and associated infrastructure, separate/downstream from the guidelines enforced upon each data warehouse by the associated credit platform... and those payment-processor-produced guidelines, might look again quite a lot like PCI-DSS :P

> But that's government regulation for you.

You misspelled “private sector”. Use of endpoint monitoring software is coming out of private auditing companies driven by things like PCI or insurers’ requirements – almost nobody wants to pay for highly-skilled security people so they’re outsourcing it to the big auditing companies and checklists so that if they get sued they can say they were following industry practices and the audit firms okayed it.

this had nothing to do with government regulation, thank private sector insurance companies.

Pci-dss is a method for card companies to allay the risk onto the merchant and away from the card companies - just like insurance.

It's definitely ironic, and compatible with the security engineering world joke that the most secure system is one that cannot be accessed or used at all.

I suppose one way to "stop breaches" is to shut down every host entirely.

In the military world, there is a concept of an "Alpha Strike" which generally relates to a fast-enough and strong-enough first-strike that is sufficient to disable the adversary's ability to respond or fight back (e.g. taking down an entire fleet at once). Perhaps people that have been burned by this event will start calling it a Crowdstrike.

It seems government IT systems in general faired pretty well the last 12 hrs, but loads of large private companies were effectively taken offline, so there's that.

What’s frustrating is that after falsely attributing pci to government regulation and being corrected, you’re probably not going to re-examine the thought process that led you to that false belief.

I think the worst part of the incident is that state actors now have a clear blueprint for a large scale infrastructure attack.

I can think of a lot better things to put in a kernel-level driver installed on every critical computer ever than a bunch of 0s.

Like what? Kernels and drivers are out of my wheelhouse, I'm just curious.

technically the 0s were a data file read by the driver, not the driver itself

You're assuming it wasn't an attack.

Just the same week Kaspersky gets kicked from the us market...

They are assuming that crowdstrike is telling them the truth, but yeah I keep thinking about Kaspersky too. That's a whole other pile of assumptions though.

> george kurtz, ceo and founder of crowdstrike, was the cto of mcafee when they did the exact same thing 14 years ago: https://old.reddit.com/r/sysadmin/comments/1e78l0g/can_crowd...

I find it amusing that the people commenting on that link are offended this called a "Microsoft " outage, when it is "Crowdstrike's fault".

This is just as much a Microsoft failure.

This is even more, another industry failure

How many times does this have to happen before we get some industry reform that lets us do our jobs and build the secure reliable systems we have spent seven decades researching?

1988 all over again again again

It's simple: the failure is not specific to the OS.

Crowdstrike runs on MacOS and Linux workstations too. And it's just as dangerous there; the big thread has stories of Crowdstrike breaking Linux systems in the past months.

Crowdstrike isn't needed by/for Windows, it's mandated by corporate and government bureaucracies, where it serves as a tool of employee control and a compliance checkbox to check.

That's why it makes no sense to blame Microsoft. If the world run on Linux, ceteris paribus, Crowdstrike would be on those machines too, and would fuck them up just as bad globally.

> That's why it makes no sense to blame Microsoft. If the world run on Linux, ceteris paribus, Crowdstrike would be on those machines too, and would fuck them up just as bad globally.

CrowdStrike _is_ running on a massive number of Linux servers/endpoints, with the same kind of auto-update policies.

>Crowdstrike runs on MacOS and Linux workstations too.

This is what chills me to the bone, there's loads of these installations worldwide on heterogeneous OSs but with very little oversight of the code. Companies have basically rolled over and stated, 'OK, we trust you'

I'm not usually a fan of strident calls to open source everything, but the source code at least for the channel file parser on all OSs should now be made public so that we can have an oversight of what so many have placed their trust in.

the reforms you're hoping for are not going to happen until the countries with bad infosec get conquered by the countries with good infosec. that is going to be much worse than you can possibly imagine

it's not microsoft's fault at all; crowdstrike caused the same problem on debian systems three months ago. the only way it could be microsoft's fault is if letting users install kernel drivers is microsoft's fault

> he lacked even the most basic technical competence in the fields where he was supposedly a world-class specialist

Pretty ironic Craig also suggests to put digital certificates on the blockchain instead of them issued by a computer or a cluster of computers, in one place, which makes them a target. A peer to peer network is much more resilient to attacks.

Was the problem, or a part of the problem, that the root certificate of all computers was replaced by CrowdStrike? I didn't follow that part closely. If it was, then certificates registered on the blockchain might be a solution.

I'm totally not an expert in cryptography, but that seems plausible.

As a side note, it is only when i heard Craig's Wright explanation of the blockchain that the bitcoin whitepaper started making a lot of sense. He may not be the greatest of coders, but are mathematicians useless in security?

none of your comment makes any sense. possibly it was generated by a large language model with no understanding of what is being talked about

is it not the problem, that CrowdStrike takes hold of the root certificate authority of a computer? There is an update, and after that what is causing the problem?

If it is the certificate, that could be solved in the future by putting the certificates on the blockchain. If it is just incompetent management, then i don't see a great deal of technical solutions.

Craig Wright, claims to be a mathematician not a stellar coder.

that comment does make some sense, but it is still wrong from beginning to end; everything it says is close to the opposite of the truth

I don't mean to sound conspiratorial, but it's a little early to rule out malfeasance just because of Hanlon's Razor just yet. Most fuckups are not on a ridonkulous global scale. This is looking like the biggest one to date, the Y2K that wasn't.

We as a society need to start punishing incompetence the same way we punish malice.

Of course, we also need to first start punishing individuals for intentionally causing harm through their decisions even if the harm was caused indirectly through other people. Power allows people to distance themselves from the act. Distance should not affect the punishment.

> We as a society need to start punishing incompetence the same way we punish malice.

Yes

But competence is marketed

The trade names like "Crowdstrike" and "Microsoft "

> Of course, we also need to first start punishing individuals for intentionally causing harm through their decisions even if the harm was caused indirectly through other people.

Legal teams are way ahead of you here, by design. They’ve learned to factor out responsibility in such a diffuse manner the “indirectly” term loses nearly all its power the closer one gets to executive ranks and is a fig leaf when you reach C-levels and BoD levels. We couldn’t feasibly operate behemoth corporations otherwise in litigious environments.

I personally suspect we cannot enshrine earnestness and character as metrics and KPI’s, even indirectly. From personal experience selling into many client organizations and being able to watch them make some sausage, this is where leadership over managing becomes a key distinction, and organizational culture over a long period measured in generations of decisions and actions implemented by a group with mean workforce tenure measured in decades becomes one of the few reliable signals. Would love to hear others’ experiences and observations.

So which individual engineer are you locking up and telling their kids that they don't get to see their mommy or daddy again?

> intentionally causing harm

Maybe we need to criminalize groundless accusations too.

I hear it was that Ron guy's fault

Don't pretend you don't understand.

Failures like this aren't an individual programmer's responsibility. I can guarantee you programmers have been asking to implement staggered releases and management shut them down. In fact another poster in this thread showed that even customers asked for that and were rejected with 50 pages of corporate BS which basically amounted to "we don't wanna".

Same goes for other safety mechanisms like testing.

> Maybe we need to criminalize groundless accusations too.

I never accused them of intentionally causing harm. Please read my comment more carefully. I said what i said because in the current environment, even doing this intentionally would not lead to sufficient punishment to top management.