Hacker News Reader

Comment by Retr0id | Hacker News Reader

A slightly bewildering fact is that CrowdStrike's terms and conditions say not to use it for critical infrastructure:

> Neither the offerings nor crowdstrike tools are for use in the operation of aircraft navigation, nuclear facilities, communication systems, weapons systems, direct or indirect life-support systems, air traffic control, or any application or installation where failure could result in death, severe physical injury, or property damage.

(Originally in all-caps, presumably to make it sound more legally binding)

https://www.crowdstrike.com/terms-conditions/

View on HN

That's a pretty standard clause I've seen in every software ToS I ever gazed my eyes upon.

As far as I know, those applications weren't affected either - airports were affected because the ticketing systems were offline. Companies not using Crowdstrike were able to fly just fine.

Edit: 911 was affected in many places, and that is definitely concerning as it is very much life critical.

Sure, the small-print is always going to say "anything bad that happens is someone else's fault", but it's a bit embarrassing when you put it next to their marketing materials.

I recently was asked to sign a thing saying it's my fault if I die while getting my hair colored

Oddly this is a thing: https://en.m.wikipedia.org/wiki/Vertebrobasilar_insufficienc...

Interesting! Happy to report I survived

"Sure the small-print is always going to say "anything bad that happens is someone else's fault", ..."

But that's not what this "small-print" says, i.e., the text you quoted and the terms and conditions page linked to in your comment.

Generally, it is not possible to disclaim liability for death, physical injury or property damage. The Crowdstrike disclaimer does not attempt to do so.

Nor do the terms ask the software user to assume any risk of death, physical injury or property damage. (Except for a warning about using "Malware Samples".)

Do they follow their own terms though, or do they still try to sell this software to hospitals without mentioning the fine print.

Do you mean hospitals, 911 dispatch centers and other critical infrastructure buys and deploys software without having the legal department carefully analyze the terms and conditions, based on the marketing materials only?

Yes. I just googled and there are a-plenty. Even Crowdstrike has a dedicated offering page for hospitals. Not sure what those legal departments you mentioned are paid for, by the way. Maybe only to silence whistleblowers?

Somewhat ironically, what CrowdStrike is doing here and what the author of this article seems to want are two manifestations of the same desire: to be compensated for one's expertise and judgement without bearing any responsibility when it goes wrong.

In any reasonably rational system, there should be some sort of balance between the two. That is hard to reach, as the various stakeholders are fundamentally at odds with one another, but it is easily believable that the dev who presses 'deploy' rarely has much of either.

This is exactly right. Disclaimer inflation has made disclaimers worthless since noone wants to bear responsibility unless absolutely necessary

And the Windows license terms, offers no guarantees of any kind, while it seems from this outage, is used at 911 response centers and hospitals emergency and surgery rooms...

" Disclaimer. Neither Microsoft, nor the device manufacturer or installer, gives any other express warranties, guarantees, or conditions. Microsoft and the devicemanufacturer and installerexclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement..."

https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...

If you think about it, any software update can make something bad happen. Maybe we just shouldn't be running bare-metal installs for critical infra in the first place. Just run a hypervisor taking snapshots daily or before updates and if it bricks a system it restarts into the last good image. Critical infra should be much more resilient and defensive than it is.

That only works if it's self contained. As soon as you need to reach out and interact with other systems, version mismatches can still cause issues even if your system hasn't changed. Integration points and input are the biggest points of failure or vulnerabilities. A system that doesn't take input or integrate with others is super easy to maintain (of course most are practically useless too).

Easier said than done, since a hypervisor is yet another moving part that can fail.

People were running Crowdstrike on AWS (which in most (all?) cases involves a hypervisor), and recovery was still painful for them.

That, or just simplifying these systems with clear boundaries between them. Why are flight status displays running Windows with endpoint security in the first place? Data could be loaded periodically from one authorized machine/job on the network with all other outbound/inbound network access restricted.

your hypervisor needs security updates too.

Maybe it'd time to concede that Tanenbaum was right.

What does the law say about situations where a salesman's promises are at odds with the EULA?

My bet is all it says is the lawyers will be getting rich.

These days - similar clauses won't hold.

Critical infrastructure should not use Internet-enabled machines.

You will still see security teams pushing endpoint protection with kernel level observability onto air-gapped systems, so this issue still exists

From my own limited experience, those air gapped systems are often no more well managed than anything else. Perhaps having one more hop between the update channel and the secure network is enough to catch crowdstrike, but don’t be surprised if it isn’t.

> You will still see security teams pushing endpoint protection with kernel level observability onto air-gapped systems

Why though? Is it just "because we do it on every other machine", scared to fail audit, or what? Obviously the regulatory environment is a problem but IT incompetence is also another.

I imagined in the past that super-critical infrastructure like the military would have a parallel network, even down to using different cables in the ground, and wouldn't share any of the IP layers with the public Internet. I guess this was feasible a few decades ago, but not nowadays.

Heard of SIPRNet, NIPRNet, and JIWCS?

I've had this discussion with many people involved in country infra. It falls on deaf ears. They talk about 'acceptable risk' and 'minimizing their long term costs' just to stay afloat while posting multi billion dollar profits.

I don't know where the delusion comes from, but some of them to go see the folly of their mistakes in the last few days. They will ride this off in the excuse that 'it affected so many other people, see, its not my fault !'.

How can you run your internet backbone without connecting it to the internet?

Infrastructure , ie.. water, power, electricity, traffic, dam control, hydrostations, sewerage etc.

My point is that a lot of critical infrastructure needs to be connected to the internet, including network (as I mentioned) and traffic control systems (as you mentioned).

I now see where you stand, and we're going to have to disagree. I've heard all the points that your side can make 20 times over and none of them are convincing. I have also learned that when people use the word "need" they have their minds made up, so no point continuing this discussion, have a good one.

Well you can't run your internet backbone at all unless you want to connect it to the internet. For something like a network of traffic light controllers, traffic sensors, variable speed signs, traffic monitoring cameras, ect... You either need to connect it to the internet, or some sort of incredible large intranet that would be distributed over such a large area as to only marginally reduce the attack surface. Unlike say a power plant, where all of the controllers, and all of the systems they are controlling can be contained within a single facility.

Reply on news.ycombinator.com