Hacker News Reader

Comment by mr90210 | Hacker News Reader

On top of that, I am still struggling to understand how the people in charge of running orgs that run highly critical systems were OK with the idea that a 3rd party software provider could push at anytime patches to the software they provide.

Sorry for being harsh with my following statement, but I believe that the companies affected by Crowdstrike share some responsibility on what happened yesterday.

View on HN

You're making the mistake of assuming that the people running those companies care about anything other than their job security, and buying in solutions is the best way to have a ready-made scapegoat when things go wrong. The mantra "no-one ever got sacked for buying IBM" still holds, you can just substitute "Oracle", or "Microsoft", or now - apparently - "Crowdstrike".

The are OK with "push at anytime patches to the software" because that's a big part of what they are paying for. Rapid response to threats.

>Ping reply from 127.0.0.1

The threat is inside the building!

- pushing patches is objectively a good idea, rapid response to threats and all.

- Whats bad is instant global 0->1 rollout, instead of more gradual, blue/green/canary however you call it. With gradual rollout policy this whole thing could have been caught at their first couple guinea pig customers, and not the whole world

You don't understand the word objective. It is beyond arrogant to think that controlling when a customer's day gets ruined is your prerogative. Let them make that decision.

It's not harsh. The tide went out and it turns out a lot of people were swimming naked.

I think I agree with you. On the other hand, I can also imagine that if autoupdates weren't the case, then 90% of installations would be a terribly outdated and probably vulnerable version. It's hard to imagine a common sense middle ground.

One could make the argument that automatically patched software is, in aggregate, more secure/less problematic than chronically under-patched software that requires manual, human attention.

One could, but in the old days when vulnerabilities happened, they didn't hit everyone at once.

And if it hit your system, the vendor's first response would be "are you on the latest update? that's been fixed."

(Unless the latest update IS the problem. In that case, being lazy was a good defense.)

They share the whole of the responsibility of it. "my antivirus was updating" is not an acceptable excuse for a service to be down.

As I understand it, customers do have control, but in this instance CrowdStrike overrode the settings of the customers.

Surprisingly, the mantra "if it works, don't touch it" doesn't really work so great.

They chose a major vendor and it checks off a compliance requirement.

Reply on news.ycombinator.com