Comment on CrowdStrike broke Debian and Rocky Linux months ago, but no one noticed

viking@infosec.pub ⁨1⁩ ⁨month⁩ ago

• finley@lemm.ee ⁨1⁩ ⁨month⁩ ago

  I was listening to a podcast earlier, and they mentioned the fact that their legal liability may, in fact, be limited because of specific wording in most of their contracts.

  In other words, they may actually get away with this in the short term. In the long-term, however, a lot of organizations and governments that were hit by this will be reevaluating their reliance on such monolithic organizations as crowd strike, and Microsoft.

  source

  • rumschlumpel@feddit.org ⁨1⁩ ⁨month⁩ ago

    and even Microsoft

    (x) doubt

    They had decades to consider Microsoft a liability. Why start doing something about it now?

    source

    • catloaf@lemm.ee ⁨1⁩ ⁨month⁩ ago

      Because cybersecurity is becoming more of a priority. The US government has really put their attention on it in the last few years.

      source

      • Tinidril@midwest.social ⁨1⁩ ⁨month⁩ ago

        I was in IT back in 2001 when the Code Red virus hit. It was a very similar situation where entire enterprises in totally unrelated fields were brought down. So many infected machines were still trying to relocate that corporate networks and Internet backbone routers were getting absolutely crushed.

        Prior to that, trying to get real funding for securing networks was almost impossible. Suddenly security was the hottest topic in IT and corporations were throwing money at all the snake oil Silicon Valley could produce.

        That lasted for a couple years, then things started going back to business as usual. Microsoft in particular was making all sorts of promises and boasts about how they made security their top priority, but that never really happened. Security remained something slapped on at the end of product development and was never allowed to interfere with producing products demanded by marketing with inherently insecure designs.

        source

        • -> View More Comments
      • Maeve@kbin.earth ⁨1⁩ ⁨month⁩ ago

        Hard to tell, sometimes.

        source
    • Maeve@kbin.earth ⁨1⁩ ⁨month⁩ ago

      Literally lol'd. Thanks for that!

      source
  • Brkdncr@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Contracts aren’t set in stone. Not only are those contracts modified before they are accepted by both parties, it’s difficult to limit liability when negligence is involved. CS is at worst going to be defending against those, at best defending against people dumping them ahead of schedule against their contracted term length.

    source
  • TheBat@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Oh so you can fire QA department, get absolutely destructive update to millions of systems across the globe and this gross negligence doesn’t matter because of magic words in a contract? I don’t think so.

    source

    • finley@lemm.ee ⁨1⁩ ⁨month⁩ ago

      That’s not what I said said

      source

      • TheBat@lemmy.world ⁨1⁩ ⁨month⁩ ago

        Then how else is their legal liability is limited?

        They killed off their QA department to chase profits which resulted in a broken product that crippled hundreds of organizations across the globe.

        They don’t get to just shrug, say oopsie, and point at the contract.

        source
• mipadaitu@lemmy.world ⁨1⁩ ⁨month⁩ ago

  They mean after Crowdstrike gets sold, the new company promises a more rigorous QA, and quietly rebrands it.

  source

  • captain_aggravated@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

    Slorp is now Bonto!

    source
  • bitchkat@lemmy.world ⁨1⁩ ⁨month⁩ ago

    I think you mean after they sell their assets to a new company. Leave the lawsuits with the old company who will shut down.

    source
  • Default_Defect@midwest.social ⁨1⁩ ⁨month⁩ ago

    Cloudstrike, wait no!

    source

    • derpgon@programming.dev ⁨1⁩ ⁨month⁩ ago

      What are you doing Counterstrike

      source