If I ever get a sales pitch from these shit brains, they will get immediately shut down.
Also fuck MS and their awful operating system that then spawned this god awful product/company known as “CrowdStike Falcon”
By the way, Falcon can be and is deployed to Linux and MacOS hosts in these organisations too it's just that this particular incident only affected Windows.
1. critical infrastructure around the globe seemed to depend on CrowdStrike
2. "If I ever get a sales pitch from..." suggested you are in an environment that is far from critical infrastructure.
It also wouldn't happen on Linux: they use eBPF there which was designed by grownups and validates its inputs.
https://developer.apple.com/support/kernel-extensions/
They’ve added system extension mechanisms for the most common needs trying to balance the various things people use kexts for against the impact on security, performance, and reliability many kexts had.
They’re just not using it. They could have not used it for Linux too. The presence of the feature is not enough to guarantee this would’ve never happened in a hypothetical.
Similarly, Microsoft clearly sees the benefits but note that they themselves say that’s not production ready yet. I’m certain that this incident will cause people to consider migrating as soon as that changes.
Let’s say Linux is the leading OS around the world. How can we be sure that they would actually use eBPF if this was the case?
They would likely choose the fastest option in order to support the platform as quickly as possible. Perhaps eBPF didn’t even exist if they prioritized Linux support and implemented that first, since Falcon was first released in 2013 and eBPF in 2014.
Switching from kernel mode to eBPF would be quite a lift, so if it wasn’t baked in from the start it likely wouldn’t have been added in after the fact.
A decade worth of changes is a lot to confidently say what would have happened. If Linux and MacOS were more popular than Windows, it could have been completely different.
This doesn’t even touch on the massive Debian incident CS had earlier this year, which is not a hypothetical.
Has this changed?