Comment by tanepiper | Hacker News Reader

Comment by tanepiper | Hacker News Reader

I know this is being used by Microsoft and other voices in tech to bash the EU, but I really don't buy that argument. For a start it would only cover the decision within the EU, yet Microsoft chose to do this at a global level - likely also pressured by previous anti-monopoly rulings in the US.

The main fall down here was a lack of rigor on their part, and Crowdstrike's. Thorough testing of all configurations of Windows is likely impossible - but it's clear this one affected so many it was a common one - why was this not caught?

As for the EU - I'd say where their problems lie is in applying rules and regulations, but only in the context of that time and space - there is no regulatory follow-up from the initial conditions to ensure that software continues to be safe, and few certifications offered outside private companies own certification. It's just been announced they are diverting budget away from FOSS projects towards AI ones in their Horizon 2025 budget, once again weakening the software ecosystem in favour of the-popular-thing-at-the-moment.

For their own sake they should be funding independent Red/Blue teams, and securing the internal supply chain of software - both to protect it from current threats, and future geo-political changes. But this is where they leave it up to market forces and this is why this situation will absolutely happen again and again.

> Thorough testing of all configurations of Windows is likely impossible - but it's clear this one affected so many it was a common one - why was this not caught?

You might want to investigte the technical details of what CrowdStrike driver actually do. It has the ability to load a configuration file that contains code and then execute that code. Crowdstrike uses their own update server. Microsoft has validated the driver but when the driver has the ability to connect to CrowdStriks servers and download code, it is hard to blame Microsoft for not checking this code. Had CrowdStrike instead chosen to use Windows Update for this, Microsoft would have checked and caught this, but CrowdStrike decided to bypass Microsoft and use their own update servers instead.

> it is hard to blame Microsoft for not checking this code

I don't blame Microsoft for the mistakes of Cloudstrike. I DO blame Microsoft for clearly fishing in troubled waters, trying to get back control during a crisis.

> load a configuration file that contains code and then execute that code

Citation needed (sorry!).

Of the reports I've read, the most technical of those only say the config files were full of null bytes, which when parsed/loaded by Crowdstrike's driver then in-turn caused their driver to perform a null deference.

...this doesn't mean that those files contain executable code; just that their driver code was sloppy for not validating file input (presumably their parser took a null-byte in its input as as equivalent to a null (i.e. an empty reference) in its internal data structures. To my knowledge, there's no indication or hint of CrowdStrike's driver doing anything like loading arbitrary binary code from those config files - or memory-mapping those files - and directly executing it via JMP or CALL or some Windows kernel functgion.

////

Apparently the the Windows kernel does allow drivers to have RWX pages (yikes!?), so I'll admit that it's possible that CrowdStrike's driver was doing this, but surely any competent driver/kernel-mode devs knows to never do this? (unless you're writing malware, I guess?): https://community.osr.com/t/windows-kernel-writeable-and-exe...

> > load a configuration file that contains code and then execute that code

> Citation needed (sorry!).

I'm unable to validate Dave's statements[0] but he's an retired Microsoft engineer who appears to know his stuff.

I definitely don't expect CrowdStrike to piss off their investors - they are and will be sweeping this under the rug, and possibly will change company name due to trashed reputation.

[0] https://www.youtube.com/watch?v=wAzEJxOo1ts

That's the point I was making through - the rigor here failed here by Microsoft allowing companies to push this kind of stuff with only some kind of basic sign-off in the distant past that they get the keys to do this.

If Crowdstrike didn't have the capacity to test this, either they should be handing it off to Microsoft to deliver through their channels, or they need to be forced to increase the testing capacity and improve the processes in their delivery (as do all companies with root-level access here)

Windows does have the ability to have sovereign builds (and has had this since 2016?), but the capability wasn't present when the decision was made (in 2006). Windows build is complex and tightly coupled with performance testing, telemetry collection, etc and at the time this decision was made, not feasible to do.

Reversing a change from 2006 would likely bring anti-trust action from the remainder of the world immediately, as that change from 2006 is relied on by everyone else globally today.

The EUs stance isn't bad either, as MS has a competitor in this space that also relies on a kernel driver (MDATP does use a kernel driver) and it is unlikely MS would remove its own competitor from the kernel (at least this item was not discussed during my time at MS and I was in the security space of Windows).

> The EUs stance isn't bad either, as MS has a competitor in this space that also relies on a kernel driver (MDATP does use a kernel driver)

The Vista era Defender was pretty limited though, very different breed from current MS security products

I don’t know why you want to absolve the EU regulators. MS was trying to lock down the kernel because Windows was quite unstable due to all the buggy kernel software everyone was using. Security was a growing concern at the time, but it was mainly the system instability. Windows was literally a joke at the time, and everyone knew what a BSOD was.

So this was a predictable (and predicted) consequence of the legislation.

And sure, MS could have released both “open kernel” SKUs and “closed kernel” SKUs, but that would have made it essentially the purchaser’s choice — which it would have been anyway with just “open kernel” SKUs, so there is literally no point.

I think you’re also suggesting that the EU would somehow continuously and independently test and certify Windows and CS software as sound and safe? The cost to do this in any substantial way would be massive — a significant fraction of the dev budgets of the products covered — Windows, CS, and all the other products covered. The entire Horizon 2025 budget wouldn’t begin to cover it.

Absolutely it wouldn't, and here is where I am saying the EU is failing the most -not considering cyber security and software resilience something to throw money at - and it shouldn't be locked up in defence budgets or other closed initiatives - it would in fact have an opportunity to create a rather sizeable bug bounty program if it wanted to.

Data and software sovereignty is likely coming and the worst thing that can happen is for everyone to end up in inoperable silos - this will make information sharing at every level more difficult.

At some point MS might also have to admit it has to fork Windows and create one more tailored to the EU regarding the different acts that are incoming.

Reply on news.ycombinator.com