I'm sorry but CrowdStrike's "technical details" post is well below the expected standard in our field. What kind of logic error was it? More importantly, what was your QA process like? Why did CI not catch it? Why was there not a staged rollout? These are the absolute basics that should be expected.
https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/
The Meta post is great. It was for an outage not nearly as bad as this, and doesn't even go too deep into the details, but:
it resolves most of the questions someone knowledgeable would ask
it talks about systemic improvements (the "storm" drills talked about were incredibly important and made many great improvements happen)
and it is personally signed by a VP of infrastructure, rather than just "Executive Viewpoint"
you know what really annoyed me?
they never said they were sorry
cop mindset, innit, tho? Since they're 'protecting' you, any harms done are the cost of that 'protection'.
Learn more about this BCS dataset that builds on the existing EMBER dataset, with extended data tags and a new leaf similarity co-occurrence algorithm that accounts for both benign and malicious binaries.
I expect that crowdstrike's legal team is -super- squirrelly about publishing details that could constitute an admission of liability, which may well play into the paucity of detail there.
Not to mention the whole issue with security companies -constantly- eliding necessary detail because it would "compromise customer operations" or whateverthefuck excuse.
Only way to get the real story in infosec is via backchannels half the time :-/
@munin @rain to this day we don’t have a clear understanding of 1) how it happened; 2) what they’re doing to prevent it again.
Vendor risk is such a nearly unspeakably huge toxic dump at most companies. We are burning so much money and energy to reign it in, but it’s an uphill battle when the part of the org that “benefits” from the “cost savings” isn’t the one who bears the cost of the compromise.
Completely agree. And trying to get vendors to even let you see their SOC2 - assuming they even have one, and assuming whoever signed the contract thought to put auditing provisions in in the first place - is a huge fucking pile of NDA horseshit.
Oh yeah. Well and truly familiar with both sides of -those- provisions lol
Thing is tho, -everyone- is trying to do their "one audit" a year, and ain't nobody hiring ......well, a -me- to handle coordinating those, or managing the communication to customers around relative exposure to emergent threats.
@petrillic
My experience exactly.
If risk could be transfered to an outsider execs were like...
@munin @rain
@rain it was nonsensical.
I am trying to extend a modicum of grace and believe they will put something more substantive out after they've had time to gather information and do a post-incident write-up.
@rain Managers and PR people always get twitchy when engineers want to speak plainly.
But when the engineers aren't allowed to speak plainly, the reader must always assume that letting the engineers speak plainly would be horrifically embarrassing so the cageyness always has a net negative PR value.
A test run?
My Spidey-sense tells me it was planned. The #Biden #economy is too good, #StockMarket doing too well, yanno what I mean?
Nahhh, couldn't be, I must be wrong
But then again...
@rain "and have no risk of experiencing this event in the future."
That is a brave statement!
fuck microsoft, windows, and all the associated bullshit.
Matt
rain 🌦️
Fi 🏳️⚧️
iximeow
Ben Aveling
MaybeMyMonkeys
Chris Petrilli
Eric Carroll
Hilko Bengen
farhaven 🇪🇺
abadidea
Karen Bruner
wrosecrans
Ada ⋆.˚🦦⋆🦌 - Neptuwunium
joe•iuculano 
RevK 
markus
Tony Finch
Matija Nalis
Alexey
tamas
Bernd Schittenhelm
Billie Thompson 🦊
sparseMatrix 📻
The Air Whisperer