Comment on CrowdStrike broke Debian and Rocky Linux months ago, but no one noticed

• SeeJayEmm@lemmy.procrastinati.org ⁨3⁩ ⁨months⁩ ago

  Turns out it was a content update that caused the driver to crash but the update itself wasn’t a driver (as per their latest update.)

  source

  • wolfylow@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Found this post that explains what happened in detail: lemmy.ohaa.xyz/post/3522666

    As an application developer (rather than someone who can/does code operating systems) I was just left open-mouthed …

    Looks like they’re delivering “code as content” to get around the rigour of getting an updated driver authorised by MS. I realise they can’t wait too long for driver approval for antivirus releases but surely - surely - you have an ironclad QA process if you’re playing with fire like this.

    source
  • b161@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

    Do you know if the sensor update policy had been set to N-2 would this have avoided the issue?

    source

    • starneld@infosec.pub ⁨3⁩ ⁨months⁩ ago

      Setting the update policy to N-2 (or any other configuration) would not have avoided the issue. The Falcon sensor itself wasn’t updated, which is what the update policy controls. As it turns out, you cannot control the content channel updates - you simply always get the updates.

      source

      • b161@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

        💀 Fucking hell CrowdStrike.

        source
    • quinkin@lemmy.world ⁨3⁩ ⁨months⁩ ago

      No it would not.

      source
  • AlecSadler@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

    Oh, wow.

    source
• mox@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago

  nitter.poast.org/…/1814343502886477857

  source