this post was submitted on 22 Jul 2024

254 points (95.0% liked)

Programming

17416 readers

38 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]

founded 1 year ago

MODERATORS

[email protected]

254

Let's blame the dev who pressed "Deploy" - by Dmitry Kudryavtsev (yieldcode.blog)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

75 comments fedilink hide all child comments

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 17 points 3 months ago* (last edited 3 months ago)

Crowdstrike CEO should go to jail. The corporation should get the death sentence.

Edit: For the downvoters, they for real negligently designed a system that killed people when it fails. The CEO as an officer of the company holds liability. If corporations want rights like people when they are grossly negligent they should be punished. We can't put them in jail so they should be forced to divest their assets and be "killed." This doesn't even sound radical to me, this sounds like a basic safe guard against corporate overreach.

[–] [email protected] 2 points 3 months ago

Imagine if he/she was Russian or Chinese...

[–] [email protected] 27 points 3 months ago (1 children)

Microsoft also started blaming th eu. Its such a shitshow its ridiculous.

https://www.tomshardware.com/software/windows/microsofts-eu-agreement-means-it-will-be-hard-to-avoid-crowdstrike-like-calamities-in-the-future

[–] [email protected] 13 points 3 months ago (1 children)

OMG the article conflates kennel API calls and kennel drivers such as what crowdstrike actually does. I refuse to read it until the end.

[–] [email protected] 6 points 3 months ago (1 children)

Kennel? You mean kernel?

[–] [email protected] 1 points 3 months ago

Opsi my dumb keyboard still haven't learned what I do

[–] [email protected] 20 points 3 months ago

Reading between the lines, crowdstrike is certainly going to be sued for damages, putting a Dev on the hook means nobody gets - or pays - anything so long as one guy's life gets absolutely ruined. Great system

[–] [email protected] 13 points 3 months ago

I blame the users for using that software in the first place

[–] [email protected] 24 points 3 months ago* (last edited 3 months ago) (1 children)

If only we had terms for environments that were ment for testing, staging, early release and then move over to our servers that are critical...

I know it's crazy, really a new system that only I came up with (or at least I can sell that to CrowdStrike as it seems)

[–] [email protected] 22 points 3 months ago (1 children)

Check Crowdstrike's blurb about the 1-10-60 rule.

You can bet that they have a KPI that says they can deliver a patch in under 15m; that can preclude testing.

Although that would have caught it, what happened here is that 40k of nuls got signed and delivered as config. Which means that unparseable config on the path from CnC to ring0 could cause a crash and was never covered by a test.

It's a hell of a miss, even if you're prepared to accept the argument about testing on the critical path.

(There is an argument that in some cases you want security aystems to fail closed; however that's an extreme case - PoS systems don't fall into that - and you want to opt into that explicitly, not due to a test omission.)

[–] [email protected] 20 points 3 months ago (1 children)

That's the crazy thing. This config can't ever been booted on a win10/11 machine before it was deployed to the entire world.

Not once, during development of the new rule, or in any sort of testing CS does. Then once again, never booted by MS during whatever verification process they (should) have before signing.

The first win11/10 to execute this code in the way it was intended to be used, was a customer's machine.

Insane.

[–] [email protected] 5 points 3 months ago (1 children)

Possibly the thing that was intended to be deployed was. What got pushed out was 40kB of all zeroes. Could've been corrupted some way down the CI chain.

[–] [email protected] 2 points 3 months ago (1 children)

Which definitely wouldn't have been a single developer's fault.

[–] [email protected] 3 points 3 months ago (1 children)

Developers aren't the ones at fault here.

[–] [email protected] 1 points 3 months ago (1 children)

Not the most at fault, but if you sign off on a shitty process, you are still partially responsible

[–] [email protected] 1 points 3 months ago

That depends entirely on the ability to execute change. CTO is the role that should be driving this.

[–] [email protected] 45 points 3 months ago (2 children)

It's never a single person who caused a failure.

[–] [email protected] 4 points 3 months ago

Yeah exactly. You'd think they'd have a test suite before pushing an update, or do a staggered rollout where they only push it to a sample amount of machines first. Just blaming one guy because you had an inadequate UAT process is ridiculous.

[–] [email protected] 2 points 3 months ago

Allow me to introduce myself

load more comments