Linux

48216 readers

630 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

AgreeableLandscape@lemmy.ml

nooter692@lemmy.ml

MarcellusDrum@lemmy.ml

cypherpunks@lemmy.ml

cyclohexane@lemmy.ml

d3Xt3r@lemmy.nz

784

Today I'm grateful I'm using Linux - Global IT issues caused by Crowdstrike update causes BSOD on Windows (www.timesnownews.com)

submitted 4 months ago by Thorned_Rose@sh.itjust.works to c/linux@lemmy.ml

193 comments fedilink hide all child comments

This isn't a gloat post. In fact, I was completely oblivious to this massive outage until I tried to check my bank balance and it wouldn't log in.

Apparently Visa Paywave, banks, some TV networks, EFTPOS, etc. have gone down. Flights have had to be cancelled as some airlines systems have also gone down. Gas stations and public transport systems inoperable. As well as numerous Windows systems and Microsoft services affected. (At least according to one of my local MSMs.)

Seems insane to me that one company's messed up update could cause so much global disruption and so many systems gone down :/ This is exactly why centralisation of services and large corporations gobbling up smaller companies and becoming behemoth services is so dangerous.

you are viewing a single comment's thread
view the rest of the comments

[–] shirro@aussie.zone 132 points 4 months ago* (last edited 4 months ago) (17 children)

I isn't even a Linux vs Windows thing but a competent at your job vs don't know what the fuck you are doing thing. Critical systems are immutable and isolated or as close as reasonably possible. They don't do live updates of third party software and certainly not software that is running privileged and can crash the operating system.

I couldn't face working in corporate IT with this sort of bullshit going on.

[–] CalcProgrammer1@lemmy.ml 28 points 4 months ago* (last edited 4 months ago) (2 children)

It's also a "don't allow third party proprietary shit into your kernel" issue. If the driver was open source it would actually go through a public code review and the issue would be more likely to get caught. Even if it did slip through people would publically have a fix by now with all the eyes on the code. It also wouldn't get pushed to everyone simultaneously under the control of a single company, it would get tested and packaged by distributions before making it to end users.

[–] Aphelion@lemm.ee 5 points 4 months ago (1 children)

It's actually a "test things first and have a proper change control process" thing. Doesn't matter if it's open source, closed source scummy bullshit or even coded by God: you always test it first before hitting deploy.

[–] cybersandwich@lemmy.world 12 points 4 months ago (1 children)

And roll it out in a controlled fashion: 1% of machines, 10%, 25%...no issues? Do the rest.

How this didn't get caught by testing seems impossible to me.

The implementation/rollout strategy just seems bonkers. I feel bad for all of the field support guys who have had there next few weeks ruined, the sys admins who won't sleep for 3 days, and all of the innocent businesses that got roped into it.

A couple local shops are fucked this morning. Kinda shocked they'd be running crowd strike but also these aren't big businesses. They are probably using managed service providers who are now swamped and who know when they'll get back online.

One was a bakery. They couldn't sell all the bread they made this morning.

[–] No1@aussie.zone 3 points 4 months ago* (last edited 4 months ago)

One shop I was at had a manual process going with cash only purchases.

That blew up when I ordered 3 things and the 'cashier' didn't know how to add them together. They didn't have calculator on Windows available🤣

I told them the total and change to give me, but lent them the calculator on my phone so they could verify for themselves 🤣

[–] Morphit@feddit.uk 2 points 4 months ago

It's not that clear cut a problem. There seems to be two elements; the kernel driver had a memory safety bug; and a definitions file was deployed incorrectly, triggering the bug. The kernel driver definitely deserves a lot of scrutiny and static analysis should have told them this bug existed. The live updates are a bit different since this is a real-time response system. If malware starts actively exploiting a software vulnerability, they can't wait for distribution maintainers to package their mitigation - they have to be deployed ASAP. They certainly should roll-out definitions progressively and monitor for anything anomalous but it has to be quick or the malware could beat them to it.

This is more a code safety issue than CI/CD strategy. The bug was in the driver all along, but it had never been triggered before so it passed the tests and got rolled out to everyone. Critical code like this ought to be written in memory safe languages like Rust.

load more comments (14 replies)