Mastodawn

#law #CrowdStrike #MO821132

@RandomDamage

As @cynicalsecurity has pointed out elsethread, this sort of provision disclaiming warranty as much as possible is very common in software licence agreements.

@cavyherd @GramrgednAngel @Violinknitter

(… Continued)

But (conversely) if you got the update Thursday evening before you powered off to go home and your work PC has not been booted up since, you may have the other kind of luck. (-:

@cavyherd @GramrgednAngel @Violinknitter

It really all depends from timing.

For example: I've read reports from people who lucked out and missed the update because contrary to the instructions of their IT people they turned off their office PCs on Thursday evening, and by the time they turned them on the next morning, the update had been withdrawn. So their PCs never had the bad "channel file".

(Continued …)
#CrowdStrike #MO821132

@ampersine @shanselman

Yes. I caught up on that after I had caught up on the FediVerse posts.

I have a suspicion that the NULs thing is one of those Chinese Whispers distortions of someone talking about NULL pointers, in turn because they've just guessed that that was the STOP that occurred. (alas, see https://mastodonapp.uk/@JdeBP/112813708543808092, though)

I've certainly not seen an authoritative analysis of the specific crash that happens, yet, and certainly #CrowdStrike has not supplied one.

#MO821132

JdeBP (@[email protected])

One interesting aspect of the #CrowdStrike saga is the #BadJournalism, where instead of actually getting a photographer out to one of the millions of PCs showing a BSOD today, some of which might even have been in the news organization's own offices, journalists have pulled up a stock BSOD image showing some random other error. I've seen critical thread/process terminations, unhandled exceptions, buffer overflows, and stack overruns so far. #NeverWindows11 #MO821132 #journalism @[email protected] @wood5y

Mastodon App UK

It turns out that there is an even lower barrier that kept this from being Linux panic day than it at first seemed.

It now transpires that the "channel file" involved is not used on the Linux version of #CrowdStrike's Falcon system, because it applies to NT's named pipes.

So if it had simply been a bad "channel file" common to more platforms instead, Black Friday could have been a hat trick combo of Microsoft Windows being taken down, Linux systems panicking, and Microsoft's #MO821132.

https://mastodonapp.uk/@JdeBP/112813114562289051

@chrisg

It's not even technically correct.

JdeBP (@[email protected])

All of the Linux people being smug don't know that #CrowdStrike's Falcon Sensor has a Linux version, that integrates into the kernel, and has "channel files" too. They have escaped through accident, not by dint of any inherent superiority. In another universe where Linux systems were instead deployed in the many businesses/public services/governments with CloudStrike as the common anti-malware choice, today would have been Linux panic day. https://crowdstrike.com/press-releases/crowdstrike-falcon-expands-linux-protection-with-enhanced-prevention-capabilities/ #NeverWindows11 #MO821132

Mastodon App UK

@shanselman

I saw an unsubstantiated claim this morning that the "channel file" to delete was full of NULs. If true, then the failure cannot even be down to a bad line of code, as it would also involve whatever tool generated the bad data file going very wrong.

However:

I am inclined to disbelieve this claim, as (for starters) this would result in a file without a valid PE header and a "channel file" is notionally an NT driver file as far as I can tell.

#CrowdStrike #MO821132 #xkcd

@L2actual

Well Randall had nothing else to do that day. (-:

https://crowdstrike.com/terms-conditions/

@cynicalsecurity

Read them and find out.

You are looking for §8.2 and §8.6.