Comment by Twirrim | Hacker News Reader

Comment by Twirrim | Hacker News Reader

It's probably been raised before, but the CrowdStrike terms of use (https://www.crowdstrike.com/software-terms-of-use/), section 6.1, have the usual blurb on them (emphasis mine):

> Neither the software or any other Crowdstrike offerings are for use in the operation or aircraft navigation, nuclear facilities, communication systems, weapons systems, DIRECT OR INDIRECT LIFE-SUPPORT SYSTEMS, air traffic control, or any application OR INSTALLATION WHERE FAILURE COULD RESULT IN DEATH, SEVERE PHYSICAL INJURY, or property damage. SOFTWARE USER agrees that it is SOFTWARE USER’S RESPONSIBILITY TO ENSURE SAFE USE OF SOFTWARE AND ANY OTHER CROWDSTRIKE OFFERING IN SUCH APPLICATIONS AND INSTALLATIONS.

We don't really think long and hard enough about isolation of systems, and what levels of access they actually need to be able to do their tasks. It's entirely practical to build completely isolated networks. US Government (and most major governments) operate classified networks with air gaps, network diodes and the like. We don't have to make everything actually internet accessible, while still retaining the ability to get data in to such isolated networks.

Now comes the important question: did CrowdStrike's sales team try to sell solutions to operators of such critical systems? If so, how hard did they push?

Given this: https://www.theregister.com/2024/07/19/crowdstrike_update_nh... someone has certainly been selling Crowdstrike software to be used on life-critical systems.

Been in Hospital IT, yes they did. Sure, they talked about not putting on "Life Critical Systems" but just about every system at Hospital is life critical. This is extremely common in IT because I'm sure Microsoft Windows has similar clause. Hell, I bet Epic (Electronic Medical Records) has some clause about "Make sure you have backups" when their whole pitch is "throw out the paper!"

I have seen first hand the mental gymnastics that finance/MBA leadership will go through to pretend to themselves (and the regulators) that a particular IT system isn’t “critical”.

“We have a tested backup paper procedure” - Yes, but have you tested being able to access that document when the system is down? Have you tested it when everyone’s workload is 5x normal during a real life incident, given that doing it on paper takes much longer and everyone’s already at the edge of their capacity on a normal day? Have you considered in a real life disaster scenario that something like 20% of the employees might just call out sick?

Of course not, but nobody asks that, so they just tick the “risk mitigated” box and don’t allocate any engineering effort to ensuring the system is robust.

Of course they did. This type of fine print is meaningless and only there to push responsibility onto their customers. This type of issue shouldn’t happen at large companies. We need regulations that create penalties and jail time for larger companies that have security incidents or other issues like this one.

We need regulations that create an environment for which those affected can directly seek retribution with full civil and criminal immunity.

I'm sure there are lesser measures that could work, but I'm exceedingly confident the above will be extremely effective.

We can look at a bit more regulated industries like airlines (see: Boeing) and see that it’s not necessarily working whatever path we’re on is certainly not that approach.

with larger corp users there is often an MSA that overrides the TOS; no idea if that's the case here, but give hospital GC benefit of the doubt re due diligence

also would be interesting if crowdstrike was installed by a reseller who specializes in healthcare / airlines, not the hospital or airline itself

waivers not always enforced, per [1]

> Courts will hold overbroad liability waivers unenforceable on public policy grounds. ... injurers routinely ignore these holdings and persist in requiring would-be plaintiffs to sign such unenforceable waivers anyway

at least one federal case in florida[2] saying advertising a product as safe doesn't defeat the EULA, but it's florida

1. https://wp0.vanderbilt.edu/lawreview/wp-content/uploads/site...

2. https://casetext.com/case/justtech-llc-v-kaseya-us-llc

NT 4 EULA had a similar note, but it was limited in scope to JAVA.

> 8. NOTE ON JAVA SUPPORT. THE SOFTWARE PRODUCT CONTAINS SUPPORT FOR PROGRAMS WRITTEN IN JAVA. JAVA TECHNOLOGY IS NOT FAULT TOLERANT AND IS NOT DESIGNED, MANUFACTURED, OR INTENDED FOR USE OR RESALE AS ON-LINE CONTROL EQUIPMENT IN HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE PERFORMANCE, SUCH AS IN THE OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR COMMUNICATION SYSTEMS, AIR TRAFFIC CONTROL, DIRECT LIFE SUPPORT MACHINES, OR WEAPONS SYSTEMS, IN WHICH THE FAILURE OF JAVA TECHNOLOGY COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL OR ENVIRONMENTAL DAMAGE.

I wonder if that's MS's Java or Sun's. If it's from a third party they probably copy-pasted the relevant paragraphs.

Quicktime also has a paragraph about not using them to operate nuclear facilities...

QuickTime? The video stuff from Apple?

Yeah, the one we had to install on Windows 98 to play MOV files. Which, I learnt yesterday[1]/[2], is the video format that turned to MP4.

[1] https://obsproject.com/blog/obs-studio-hybrid-mp4

[2] https://news.ycombinator.com/item?id=40951187

The Quicktime nuclear clause also got copied into the iTunes EULA, which is extremely funny.

Well shit, I guess I have to pivot. I was going to operate my nuclear facility with Quicktime.

I probably shouldn't mention how UK Nuke subs used to use WinXP. Maybe they still do. Even if they were using CS, I doubt they would update systems while deployed. I had this horrified image of a nuke sub at the bottom of the ocean while the onboard IT tech was trying hard to make sense of why all the critical systems kept blue-screening.

https://www.theregister.com/2008/12/16/windows_for_submarine...

The disclaimer about not using Java for X, Y, and Z was part of the Java EULA for many years (and my still be - no idea).

If I recall correctly, part of the context for this was that Microsoft had shipped its own implementation of Java separate from Sun's, but it only implemented a subset of the language.

https://en.wikipedia.org/wiki/Microsoft_Java_Virtual_Machine

I remember it being a superset, they added an extension to make implementing native methods easier on windows. ActiveX Jdirect or something like that.

I don't think an EULA absolves you of any possible liability. Courts can more or less decide to ignore it if they see sufficient reasons to.

Why does the hospital get a pass? They have critical care equipment, with no redundancies, and no plan to deal with an outcome so predictable it's been in EULAs for decades.

These lessons need to cut in all directions. If you want to profit off of treating disease you should be held to a much higher standard. Passing the buck off to your AV provider is convenient in the current atmosphere but it's incredibly short sighted.

> If you want to profit off of treating disease you should be held to a much higher standard.

The consequences of which will be even higher costs for an incredibly marginal improvement in outcomes.

We spend ~$13,500/year/person at the moment, what's another few thousand to that number, for an average gain in a few life-days-per-person?

At some point, you have to accept that medicine is an unlimited money hole, and that it can always do better, and that people are going to die, and that you're going to have to draw the line at some arbitrary cost/benefit limit.

> and that you're going to have to draw the line at some arbitrary cost/benefit limit.

Well US is spending significantly more money than all other highly-developed countries with (on average across population) worse outcomes than many of them to show for it. Also there is a lot of variance inside the country (i.e. the cost of identical treatment might vary wildly depending on health/insurance/etc. provider) making cost/benefit analysis semi meaningless.

If you've got a defendant with a war chest of several billion USD there's going to be a very drawn out legal process.

I suspect that if the operators of such facilities obeyed all of the terms of use for every product they wanted to use, they’d be using pen and paper for everything…

No, that’s why medical and aviation products are expensive and these are difficult markets to penetrate.

The degree of reliability that is required is insane, I cannot read the article since I am outside the US, BUT if these are the terms of service and the product was used in any area the was excluded under these terms, the entity that used the product might very well be guilty of gross negligence.

and it was not. No plane was flying with that software. It was booking services and similar needs. Planes could fly just fine, it was impossible to book people, thou.

My guess is that it's similar in this case. (Site is down)

Hospital networks and computers running Epic are very much indirect life-support systems, faulire of which can cause lots of injuries and deaths - as we're learning now in real-time.

I'm hearing that most hospital cybersecurity insurance requires Crowdstrike (or a product like it) on all the endpoints, so if that's true the liability might fall back on them. It will be a protracted argument for sure.

This is likely the case in a lot of places. We're still in the midst of ransomware groups targeting hospitals.

> communication systems

So anything connected to the Internet? Shame on these lawyers.

That's only legal until a court throws it out

Reply on news.ycombinator.com