CrowdStrike CEO apologizes for tech outage | Hacker News Reader

CrowdStrike CEO apologizes for tech outage

reuters.com

18 pointsBluestein37 comments

Microsoft needs to apologize too... they recommended CrowdStrike to customers. See for example: https://learn.microsoft.com/en-us/mem/intune/protect/crowdst...

Apparently there was no vetting of this company before allowing them to mess with the Windows kernel. Apple has more vetting before they will let even a TODO list app into their app store.

What should Microsoft have done? Require CrowdStrike to have documented processes, and require periodic (like every 6 months) third-party auditing that they have the right processes, and they are complying with their own processes.

SOC 2 requires this, see https://en.wikipedia.org/wiki/System_and_Organization_Contro...

Microsoft allows kernel modules freely [1]. Microsoft does have a process for signing kernel modules, but it is aimed against malware and does not discriminate on the nature of the module [2].

Apple removed support for kernel extensions in Big Sur [3]. Before that, you could sign kernel extensions as long as your Developer ID was permitted, without any requirement to submit the kernel extension to Apple for review [4]. Ironically, the main justification for Apple removing kexts was system stability, because a majority of companies are incapable of writing stable kernel extensions.

Nonetheless, Microsoft is historically more restrictive here than Apple.

[1] https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

[2] https://learn.microsoft.com/en-us/windows-hardware/drivers/i...

[3] https://support.apple.com/en-us/120363

[4] https://developer.apple.com/help/account/reference/supported...

edit: I would like to add, Windows can't just remove kernel modules. It would be a bloodbath. Apple can only get away with it because they're Apple.

Apple removed kernel extensibility because a majority of companies are incapable of writing stable kernel extensions? That's exactly the right thing to do.

Microsoft may have very stringent controls on how kernel code is tested... but then then they allow a company that does not have similarly stringent controls to extend the kernel... what good is the care with which Microsoft tests kernel code?

You can't just blame the third party in this situation. Microsoft gets the blame at the end of the day, see: https://www.washingtonpost.com/technology/2024/07/20/microso...

You don't need to be in kernel space to brick a computer- you can easily do it from user space!

You also don't need to be using Windows. Linux has kernel modules with no restrictions whatsoever (not even signing!), yet we run manage to run Linux stable in mission critical environments that we rely on every day.

I don't believe in the fear mongering here. Every competent engineer knew that security/antivirus vendors develop absolute trash code since the start of the century, and that extends to their kernel modules. It is no surprise- so why pretend to be surprised? With that said, I believe everyone is trying to pass blame, but at the end of the day, the blame resides solely with the organizations that purchased their product, or, the industry pressures that necessitated it.

> organizations that purchased their product

I wouldn't blame the victim here. Microsoft endorses CrowdStrike's product so why would they not purchase it?

> or, the industry pressures that necessitated it

Those "industry pressures" are under Microsoft's control.

The guy who used to run Windows division at Microsoft now says: "From now, the only strategy that is not negligence is to move critical infrastructure to mobile devices." [1] Why can't Windows be just as safe as those mobile devices? It is Microsoft's fault that it isn't.

[1] https://x.com/stevesi/status/1814711163860754564

What you are proposing is more complicated than it seems. For example, the Digital Markets Act in the EU is in direct contradiction to your proposition. There is a lot of people that believe locking down devices, even in the interest of security, is anti-competitive.

Windows and MacOS are historically much less restrictive than any Mobile OS. I am confident that if Microsoft and Apple attempted to be more restrictive, in the interest of security, it would invite further discussion of anti-competitive behavior and subsequently antitrust. In addition, if those restrictions were damaging to a company worth >75B (CrowdStrike).

I too wish it were different, but the cat is out of the bag.

I guess I agree Microsoft shouldn't be endorsing like this, but access to the kernel is a good thing for other developers. What IT overall should've done was even 1 day of rolling updates. Just something to test it before deploying world-wide. I feel for my company's IT but if (and idk how it's deployed, maybe they can't) they could not deploy updated to everyone at the same time, that would've fixed this.

SOC 2 and other similar certifications are just bare minimum checklists. More often than not, they distract teams by making them chase unimportant things just to say they’re certified. If you have been through the process this is very obvious. I’ll also note the SOC standards come from an accounting organization not a technical one.

The statement is worded to imply CrowdStrike is working to get everyone’s systems back up. In reality it’s local IT that has to remediate the problem.

And it was random people on Reddit providing strangers with support to quickly recover.

(What was that saying again "privatize the profits and socialize the burdens"?)

By the time my IT guy got to me, I knew what the solution was, I just needed a decryption key.

That sounds ominous. So sorry.-

Interesting to see how this was caused. Was it moving a person from the sales org to CTO? Aggressive cost cutting like laying off QA or moving from the valley to Austin?

Company is done like Solarwinds.

As someone from Austin (now live elsewhere) this remark is really interesting to me. Have there been companies that have moved from the valley to Austin and seen significantly worse outcomes and the move can be pointed to as a reason? I can imagine why it would be so, but if you have examples that would be even better!

It was statement on moving especially for cost reasons. See Boeing move from Seattle.

Adding to the injury, it would appear other bad actors are impersonating CrowdStrike to further nefarious ends ...

He’s a non technical founder and CEO. I’m not surprised to see this failure from them. In my experience people from backgrounds like sales or finance have no competency for leading technology companies. And that’s most companies today. Yet they’re continually propped up by their peers above leaders that possess technical and other skills, and can actually make the right choices in guiding their company and product.

You have no idea what you are talking about. George Kurtz authored the Hacking Exposed book over 25 years ago. That’s not really a sign of a non-technical person.

https://archive.is/KhRDl

> "We're deeply sorry for the impact that we've caused to customers, to travelers, to anyone affected by this, including our company

“We’re sorry for you, but think of us, we should all be sorry for poor us, too!”

He did ok at first but couldn’t help including themselves in the victims list.

And unless they are sending workers to reboot customers’ machines, they are not really helping as much as they imply.

I think this outage is easily avoidable with better processes, and I have no skin in the game (was unaffected personally), but I don’t really see anything wrong with including the company. He basically flushed everyone’s stock down the toilet and possibly doomed the company in the long term, and lots of people like having jobs and it’s disruptful to them. Do you think this is appropriate in general, just shouldn’t be in the public statement and instead in an all-hands? Or would apologizing to the company always be seen as in bad taste to you?

That's fair point. But I would have done it as two separate messages: one for internal use, and one for the customers. Otherwise putting themselves on the same kind of level as hospitals and 911 centers which were impacted kind of ruins the apology.

> And unless they are sending workers to reboot customers’ machines, they are not really helping as much as they imply.

That's the (further) thing that makes this sleazy beyond any measure: Not only the whole "feel sorry for us too!" thing, but how they are bending these statements to imply they have some part - any part - in any reparations. As mentioned upthread, the burden is being borne by others. Not them.-

Not sure "My bad G" is gonna cut it

He's a billionaire and was a CXO at McAffee during another breach/hack. Go after him. We'll find out how many people died in a few weeks/months.

Re: Compensation, as per MarketWatch:

"Kurtz’s total compensation was 237 times that of the median compensation of CrowdStrike’s employees and was more than that of five of the CEOs of the group of tech companies known as the Magnificent Seven.

The only more highly compensated CEOs among that group last year were Apple Inc.’s AAPL, +0.06% Tim Cook at $63.2 million and Microsoft Corp.’s MSFT, -0.74% Satya Nadella at $48.5 million.

Jensen Huang, CEO of Nvidia Corp. NVDA, -2.61% — which saw its stock soar 214.9% in the fiscal year through January — received $34.2 million in total compensation last year."

he doesn’t even make a million in cash, most of his comp is in stock in a company he founded but only owns 0.5% of, which is gonna hurt bad after this. Elon gets billions in stock tranches and isn’t even mentioned here (because it’s performance based, I assume).

I have four questions for Kurtz:

1. In 2010 you were CTO of McAfee when they shipped DAT file version 5958 which caused thousands of computers to crash. In 2024 you’re CEO of CrowdStrike which has caused millions of computers to crash. Why haven’t you learned from your mistake the first time and how many do you aim to crash in 2038?

2. McAfee was forced to sell itself to Intel as a result. Who do you think will buy CrowdStrike once this debacle is over?

3. You left McAfee because you saw a laptop on a plane take 15 minutes to upgrade McAfee’s software. What do you have to say to everyone who was on a plane that was grounded for hours because of the CrowdStrike upgrade?

4. You were paid 46 million USD for the previous year. How much do you think you personally owe in compensation for your latest blunder?

Let's be honest, he will resign in 2 weeks and move to the next company to be a glorified salesman. I wonder if the companies affected by this will sue Crowdstrike and the CEO or he'll just leave in peace pretending he did a good job there.

> and how many do you aim to crash in 2038?

Lets really really hope none (get crashed).-

  PS. I can totally see some semi-sentient AI going down, while - by then - we all depend on it for nearly everything, or, many things ...

You don't know George at all.

wow 2010 is as far back as 2038 is in the future!

Time ends at 3:14:08 UTC on January 19, 2038.

I don't think we can explicitly blame Kurtz for this one though.

This made me feel old…2010 was only like 3 or 4 years ago, right guys…?

Who is CloudStrike?

You edited your post, which originally said CloudStrike. You make very bold criticisms for who gets the name of the company wrong.

Reply on news.ycombinator.com