There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

woelkchen ,
@woelkchen@lemmy.world avatar

Meanwhile a Microsoft employee on how to prevent such an issue under Linux: www.phoronix.com/…/systemd-Auto-Boot-Assessment

800XL ,

I don’t know enough about Windows 10/11, but aren’t they supposed to boot into a menu thet allows you to pick the last known good configuration before it evens boots to the gui?

woelkchen ,
@woelkchen@lemmy.world avatar

It’s been a while since I had such a massive problem under Windows but the last time you could try to restore one of the last backups and usually that failed because Windows restore points are/were crap.

Damage ,

Yeah we tried that where I work (I’m not IT) and it failed. Safe mode didn’t work either 'cause it couldn’t authenticate the user for login as the server was down as well.

jonc211 ,

Apparently it’s because CrowdStrike installed their device driver as one that must start when Windows starts.

Explained here: youtu.be/wAzEJxOo1ts?feature=shared&t=675

I’ve linked to the specific time where he explains that issue, but tbh the whole video is worth watching.

apfelwoiSchoppen ,
@apfelwoiSchoppen@lemmy.world avatar

Oh FFS. I love this era where companies will not accept the blame due to “liability”, even when they are explicitly to blame.

Blue_Morpho ,

We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer. Because anything else means Microsoft is in control and not the software you installed.

It’s no different than Linux in that way. If you install a buggy device driver on Linux, that’s your/the driver’s fault, not Linux.

TimeSquirrel ,
@TimeSquirrel@kbin.melroy.org avatar

You are not wrong, but people don't want to hear it. Do we want to retain control over what goes into kernel space or not? If so, we have to accept that whatever we stuff in there can crash the entire thing. That's why we have stuff like driver signatures. Which Crowdstrike apparently bypassed with a technical loophole from how I understand it.

Cyth ,

I actually agree, I own my computer / OS and I should be able to do what you’re saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.

Feyd ,

That doesn’t make any sense. How does arguing against your position do anything but harm it?

Maybe just give them grief over the myriad negative things they do that don’t counter your position?

Blue_Morpho ,

You are going to give grief to Microsoft for allowing what you want?

???

kescusay , (edited )
@kescusay@lemmy.world avatar

The thing is, Microsoft’s virus-scanning API shouldn’t be able to BSOD anything, no matter what third-party software makes calls to it, or the nature of those calls. They should have implemented some kind of error handler for when the calls are malformed.

So this is really a case of both Crowdstrike and Microsoft fucking up. Crowdstrike shoulders most of the blame, of course, but Microsoft really needs to harden their API to appropriately catch errors, or this will happen again.

I’m an idiot. For some reason, I was thinking about the Windows Defender API, which can be called from third-party applications.

Heavybell ,
@Heavybell@lemmy.world avatar

I don’t believe there was any specific API in use here, for virus scanning or not. I suppose maybe the device driver API? I am not a kernel developer so I don’t know if that’s the right term for it.

Crowdstrike’s driver was loaded at boot and caused a null pointer dereference error, inside the kernel. In userspace, when this happens, the kernel is there to catch it so only the application that caused it crashes. In kernelspace, you get a BSOD because there’s really nothing else to do.

youtube.com/watch?v=wAzEJxOo1ts

kescusay ,
@kescusay@lemmy.world avatar

I stand corrected. For some reason, I was thinking they used the actual Windows Defender API, which can be called programmatically from third-party applications, but you’re correct, it was a driver loaded at boot. Microsoft isn’t at all at fault, here.

catloaf ,

Isn’t that API what the article is talking about?

NeoNachtwaechter ,

They are legally required to let Crowdstrike crash your computer.

I call Bullshit.

If it had been Windows NT 3.5, there would have been no bluescreens around the world. It would have stopped the buggy software, given a message accordingly, and continued it’s job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.

Now you tell me that Windows NT 3.5 is illegal?

MinFapper ,

You could absolutely install software on Windows 3.5 that would crash the system.

OfCourseNot ,
@OfCourseNot@fedia.io avatar

Can confirm. I've crashed most Microsoft products from msdos 5.

vorsprung ,
@vorsprung@hachyderm.io avatar

@OfCourseNot @neme @apfelwoiSchoppen @Blue_Morpho @NeoNachtwaechter @MinFapper
My dislike for MS products goes back to 1979 and the BASIC interpreter on the Commodore Pet.
At the time I thought that's just how computers are but within just a few years I realised that non Microsoft BASIC always seemed to be better...

Blue_Morpho ,

I ran 3.5. Yes, a network driver crash would blue screen NT3.5. Graphics were in user space in 3.5 so a video driver couldn’t take NT 3.5 down but networking was in the kernel. en.m.wikipedia.org/wiki/Hybrid_kernel

NeoNachtwaechter ,

a network driver crash would blue screen NT3.5.

OK, and… Were the legally required to make it crash?

admin ,
@admin@lemmy.my-box.dev avatar

We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

Sorry, how is that related to the stability of the kernel?

Blue_Morpho ,

I explained in my second sentence.

“They are legally required to give Crowdstrike or anyone low level access to the OS.”

If you install a buggy driver into Linux and it crashes, that’s not a problem with the Linux kernel.
www.redhat.com/sysadmin/linux-kernel-panic

admin ,
@admin@lemmy.my-box.dev avatar

I fully agree with you on that front, but ads have nothing to do with kernel access, so how is that relevant to their legal requirements?

Blue_Morpho ,

I was explaining why everyone hates on Microsoft but the Crowdstrike crash had nothing to do with the reasons people hate MS.

admin ,
@admin@lemmy.my-box.dev avatar

Gotcha.

0x0 ,

Yeah I saw the article that says they’re legally required but until I can actually read that document where it says “thou shall give everyone ring-0” access I’m gonna call it bullshit.

Blue_Morpho ,

If it’s not ring 0, it’s not full access. They are legally required to give full access.

0x0 ,

I’ll believe it when I read it.

sunzu ,

This whole thing just exposes that people getting paid big bucks for this shit, aint really that smart or planning for anything, they are just collecting rent until something blows up lol

SlopppyEngineer ,

They just pay so when it goes sideways they can hold up their hands and point out a reputable supplier was used and now it’s not their problem or blemish on their career.

Damage ,

I’m pretty sure that if Microsoft provided a decent way to do what Crowdstrike does, most companies would opt for that.

So… Sucks to suck I guess.

admin ,
@admin@lemmy.my-box.dev avatar

Personally, I don’t see the issue. Microsoft shouldn’t be responsible for when a third party creates a buggy kernel module.

And when you, as a company, decide to effectively install a low-level rootkit on all your machines in hopes that it will protect you against whatever, you accept the potential side effects. Last week, those side effects occurred.

0x0 ,

MS gives them access, so they’re responsible.

www.youtube.com/watch?v=wAzEJxOo1ts

admin ,
@admin@lemmy.my-box.dev avatar

I disagree. As someone else in this thread said: if you compile a buggy Linux driver that crashes the system, it’s still the fault of the driver.

0x0 ,

I’m not exempting Crowdstrike and I’m not sure the comparison holds: linux is a kernel, mot a corporation.

Try Ubuntu or RedHat, would they be liable?

admin ,
@admin@lemmy.my-box.dev avatar

My answer might surprise you, but no. Your source code, your binary, your responsibility. Not that of the platform, the compiler, or the company that supplies it.

henrikx ,

I bet you love your locked down iPhone too

0x0 ,

Why would I buy an Apple product?

OfCourseNot ,
@OfCourseNot@fedia.io avatar

Hard to say yet, if Microsoft is responsible or not. The thing is they certified it, as a stable and tested driver. But it isn't just a driver, but an interpreter/loader that loads code at runtime and executes it. In kernel mode. If Microsoft knew this they're definitely responsible for certifying it, but maybe crowdstrike hid this behavior until it was deployed to the customers.

Zak ,
@Zak@lemmy.world avatar

The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers.

The document does not, however say those APIs have to exist. Microsoft could eliminate them for its own security products and then there would be no issue.

0x0 ,

The document that outlines the agreement between Microsoft and the European Commission is available as a Doc file on Microsoft’s website.

…which seems to be inaccessible. I highly doubt this document specifically said “giv’em ring-0 access”, this is just MS trying to deflect blame and cash it at the same time.

catloaf ,

Is this even relevant? Wasn’t it a kernel driver module?

brianorca ,

It’s a third party kernel module, which Microsoft would love to be able to block, but legally can’t. It’s technically possible to write a virus scanner that runs in user space instead of the kernel, but it’s easier to make sure everything gets scanned if it’s in the kernel.

HubertManne ,

even when it was the bears I knew it was regulation and taxes.

sunzu ,

why do communists hate free market and liberty?

HubertManne ,

won't someone think of the corporations!?

sunzu ,

they feed you, shit lord... show some respect for your betters!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •