Hacker News Reader

Comment by codeulike | Hacker News Reader

Crowdstrike deserved to go bankrupt for this nonsense, they weren't testing properly, and they rolled their crap update out to the whole world without a staged rollout or canary system: https://x.com/cyb3rops/status/1821096079372251203

Just googled their share price and they are 34% higher than they were before the shitstorm they caused.

View on HN

Just like other security software that's big right now, I'm sure the news that it took down most of the IT systems on earth was great news to shareholders that the software had solid market penetration and most of all that even perhaps one of the biggest outages didn't cause people to leave.

The same with Zscaler - people about as far from tech I'm friends with complain to me about how much they hate it so you know /it's everywhere/

If all software engineering businesses and engineers that do not test properly went bankrupt then this website wouldn't exist.

Oh come on, we all know and expect bugs, but this was something spectacularly bad. They caused the very thing people were paying them to try and defend from. This incident had very real and serious consequences. https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_ou...

So let the market sort it out. Turns out their clients don’t think the consequences were that serious.

Turns out their clients don’t think the consequences were that serious.

Yeah, thats an interesting point. I'd be interested to read analysis on that. Maybe being seen to pay for something that claims to make things more secure is more important than actually being more secure.

Delta Airlines thinks its serious.

https://www.theregister.com/2025/05/07/delta_crowdstrike_cla...

The lawsuit appears to be about the lack of refunds, and even mentions Delta explicitly declined help from Microsoft and CrowdStrike. So how does that indicate Delta thinks "it's" serious? And what is "it"?

They want compliance not security. Maybe if it's enough for compliance but not enough really then whoever makes compliance standards should be fired

More like let the market litigate it out.

They didn't really argue otherwise, just remarked that they think it was.

What's your point?

My point is that the first post says that Crowdstrike deserved to go bankrupt, but that is up to their clients to decide. Standards for software are very low, and we all profit from that, so better not rock the boat.

Ok that is an interesting point. But my concern with crowdstrike is that the standard seems so very low (imagine the sort of mishaps Mr Bean might have if he moved into the cybersecurity field and you're not far off) that something other than the quality of the software must be driving things. Compliance tickboxing perhaps?

and that would be a bad thing?

You have to, because attackers aren't using canary systems. What good is it, if someone finds a new unauthenticated RCE in Windows, and you have to wait a week to make sure your detection method works correctly? By the time the week is over, every computer in the world already has the virus. And then you have to wait another week to test your removal tool.

No, you don't have to. Crowdstrikes own documents say they should do a staged roll out rather than all-at-once

Not only them, unfortunely proper liability is yet to become as regular as in other industries.

Reply on news.ycombinator.com