160
“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
(arstechnica.com)
this post was submitted on 21 Aug 2024
160 points (98.2% liked)
Linux
5191 readers
37 users here now
A community for everything relating to the linux operating system
Also check out !linux_memes@programming.dev
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The Crowdstrike problem was in fact a Crowdstrike problem. It affected Linux too, but of course there are vastly fewer users of Crowdstrike on Linux: https://www.google.com/amp/s/www.theregister.com/AMP/2024/07/21/crowdstrike_linux_crashes_restoration_tools/
This is pretty obviously a Microsoft problem.
Well… yes and no.
The fact that Crowdstrike very obviously and intentionally fuzzed the line between ring 0 drivers and app metadata simply could not have been done without MS’s tacit (at the very least) approval. The initial version where Cloudstrike introduced that side loading threat definition update vector should have been flagged as an issue - more specifically, they should have held them to a FAR more rigorous testing and resiliency standard than they were. This is fairly standard practice (and in many cases enforced as regulatory measures) for highly critical systems and components in a lot of industries, and I’ve worked in two of those industries.
Yeah, that part is pretty wild and definitely Microsoft's fault.
Microsoft creates secure boot: “we should be able to run whatever we want on our hardware!”
Microsoft lets users install crowdstrike on their computer: “Microsoft shouldn’t let us run this on our hardware!”
Way to miss the nuance lol
What I’m saying is that if a system claims to rigorously validate code that runs in a particular sensitive domain (here, ring 0), it should actually rigorously validate code. This was a process failure at the end of the day.