Hacker News Reader

> No one forced Delta to buy a software which could force upgrades in their production fleet.

Except this update was one from CrowdStrike that would ignore Delta's stated update policy.

And they literally said "Oh, yeah, we can configure some updates to bypass your policy". I wonder how well this was communicated to those customers.

View on HN

Did crowdstrike force delta to accept running what essentially is a permanent RCE in their production fleet? You do not buy a software that is capable to do that and you put the fact it's not capable of doing that in the contract.

The update policy may work for the client version updates, but not for the "policy definition", otherwise delta won't get the sweet "all vulns mitigated with a 4h SLA" they crave.

Reply on news.ycombinator.com