CrowdStrike Disaster: It's Not a Windows Problem ...

[@iBolski]

The entire co-pilot announce is what eventually made me switch. I still dual-boot into Windows for the one or two apps that I don't have a good Linux alternative two, but even then, I find that very rare. Eventually, I'll probably just remove Windows altogether, but not yet. Linux has provided me what I need for productivity, as well as gaming and other entertainment. But that's me.

[@spoobspoob2270]

@@iBolski I've always wanted to get rid of my dual boot, but finally decided on a solution that's kinda dumb but I liked it I bought an HP EliteDesk and slapped a GPU in it to make a cheap gaming machine that is still mostly capable, so I can finally have the excuse to run Linux exclusively on my main machine. I have them connected by an Ethernet cable so I can use Sunshine/Moonlight to stream it, so I never have to leave the comfort of my Linux desktop :)

[@Ifæn21]

@@spoobspoob2270 Did you tried Looking Glass or GPU Passthrough? Even there is Single GPU Passthrough. It's kinda difficult to set up for some, but is a good alternative to have both systems without having dual boot

[@EmmaEG]

I'm from Argentina, my english is not the best, your way to speak slowly and clearly is great, thanks for your videos!

[@RomainDelmaire]

One of the most annoying thing about the Linux community is how many people THINK they understand how things work when they actually have no clue. This is another example.

[@databug]

I always assumed that Linux users where more tech savvy than Windows users. Probably on average this is true but that unfortunately doesnt translate to "always having a clue". Sadly there is also a degree of cultish behaviour among Linux users both when it comes to viewing every other OS as inferior and even within the Linux sphere when it comes to "flavour of the Month" distros to hate on. I always say the Linux community is one of the best things and one of the worst things about Linux.

[@SvalbardSleeperDistrict]

Well, that's a general observation - especially for anything involving online discussions - and not specific to any individual community.

[@TheDeuo]

Y E S, People do need to read, a lot of my friends blamed Microsoft when Microsoft had NOTHING to do with Crowdstrike at all, it was all Crowdstrikes fault and I don't understand why people don't understand that. Microsoft can't stop everything from breaking their systems especially when it was the user / business that installed the software in the first place. You should have known what you were entering into, but also Crowdstike should have known to test everything they do before they push it to production -_-

[@MichaelNROH]

Yeah, an issue like this cannot slip through

[@NiffirgkcaJ]

"Real men test in production." - CrowdStrike CEO

[@TheDeuo]

@@NiffirgkcaJ Jesus, well that's never the best idea and definitely not for them since they took down entire organizations infrastructures, required machines, whatever etc, sadly even hospitals affected, if that man wants blood on his hands then he's certainly going there.

[@GapRecordingsNamibia]

Who gave Crowd Strike kernel access to the Windows OS? Did MS insist that all CS's kernel updates first be tested? Who's idea was it that N1 and N2 policies that hospitals, banks and airports all have in place be bypassed..? MS should carry just as much blame, to whom else have they given kernel access?

[@NiffirgkcaJ]

@@GapRecordingsNamibia oh my gosh, Microsoft tried to lock down their kernel back in Vista but was vehemently opposed by antivirus companies, especially McAfee and Symantec, with the latter launching an antitrust lawsuit against Microsoft in the EU. Also, don't just think that it's just Windows that was affected by CrowdStrike's negligence; several Linux distros were also affected by their ineptitude for quality control. All of these companies that got validated by Microsoft were given that, because if they don't, they'd be fined and probably will be sued once again for antitrust when they lock it again, but thanks to CrowdStrike's carelessness, Microsoft now has a lot of leverage to protect themselves and to containerize software instead of giving them kernel-level access. Linux, on the other hand, is fully open-sourced, and anyone could write faulty kernels for it; they were also affected at one point by a single party. So who's to blame now? Oh! Another thing: let me see you try to maneuver the entire company with several businesses in multiple industries such as gaming, enterprise software, cloud services, and hardware divisions, to name a few, just to force countless partner companies that were most likely validated automatically.

[@UltraZelda64]

Although this was really not Microsoft's fault, it was the direct result of a Windows/CrowdStrike monoculture that allowed it to become such a massive problem in the first place. Any software that has hooks directly into the kernel is suspect in my opinion, no matter the OS, and CS is definitely guilty here. Windows and/or CrowdStrike, whatever the monoculture, it's all bad. We need diversity from top to bottom. This is what *not* to do. Take note, all users of CrowdStrike on Windows.

[@dawidkrol1]

The Linux version of CrowdStrike had nearly the same problem, but it was contained quickly.

[@GASTBF]

exactly. But linux fanboys were like "haha windows bad, switch to linux"

[@Software-sb1gx]

wasn't that the whole point... that windows had a parallel issue that made affected machines unbootable?

[@simontaplin]

There was an Azure outage just before the crowdstrike problems began. But it was not related to crowdstrike in any way

[@Totallynotmwa]

ngl i thought at first microsoft messed up till i later discovered it was crowdstrikes fault

[@MichaelNROH]

There was so much going on, but yeah

[@F_Around_and_find_out]

Nothing but the OS should run in ring 0. Anything that does require ring 0 like GPU drivers must be tested thoroughly and at least a couple rounds of testing. Like a lot of things are packed into the Linux kernel, including GPU drivers but I myself never experience catastrophic failure, yet. Crowdstrike on the other hand just did one of the most successful trickled down attack in history with just one faulty driver.

[@TurntableTV]

Well, I think you're wrong. The fact that Microsoft still allows ring0 access to their kernel is mindblowing. Restricting access to windows api should be their job. That's why kernel level anti-cheat software should have no business working as a driver and communicating directly with the hardware.

[@pip5528]

I was at work when this happened but strangely it didn't affect my workplace. I had heard about it through KZbin.

[@quantumangel]

Actually, Microsoft is a partner of crowdstrike and includes the software in one of their Enterprise packages (I think azure sentinel?). Also their kernel should have safeguards and failsafes against this kind of error. Microsoft is partially responsible for the problem. Plus, even ignoring this, their os is terrible and should never be deployed on critical infrastructure; with it without endpoint response software.

[@questionlp]

There are companies that require software like CrowdStrike Falcon on their servers as part of various compliance requirements (I have now worked for 3 organizations that have had to implement it on servers and watch it cause issues with web application servers) and there is a version of Falcon for Datacenters and Microsoft has their version for Windows servers. That's part of the reason why a CrowdStrike Falcon update did hit Linux systems as many were servers.

[@diginomad6016]

All of a sudden you sound like great scott channel 😮

[@falajose3080]

Some immutable linux distros probably would be immune to this. But, I agree that most linux machines would be affected

[@MichaelNROH]

Depends on the rollout I guess. If you enroll the software with some Endpoint Management and the appropriate workarounds then they could also be affected. Like reinstall it after a system update

[@petersimmons7833]

Immutable Linux would be immune to SOME types of vulnerabilities. But definitely not all types. Most attacks these days use live-off-the-land rather than custom-compiled software of 5 years ago.

[@falajose3080]

@@petersimmons7833 I was thinking cloudstrike case. I do agree that immutable distros will be vulnerable to malicious attacks

[@Nostalgium.]

I wish I could make the switch, but I guess my pc is not that compatible with Linux because every distro I tried has this weird "bug" where my pc freezes constantly, and it doesn't matter if I'm on Wayland, x11, gnome, KDE, XFCE, it will always freeze, and I've worked really hard to fix this because I want to use Linux, but I just can't, whether on Nvidia or AMD it just won't work without freezes when my pc on Windows runs well.

[@pip5528]

In that case I would recommend Linux-compatible hardware. You don't necessarily have to go as far as a Linux OEM but researching components for compatibility goes a long way. My HP 8200 Elite SFF is old but it runs newer distros and packages better than old ones, including Wayland on a 1050 ti although X11 doesn't have jitters in games on there. My Acer Nitro 5 laptop runs Linux quite well but it tends to cause static when running the Windows drive and the second instance of static I had was so bad that even Linux would hard shutdown so I scrapped Linux on that machine altogether and reclaimed my second SSD. What's funny is that a lot of its hardware is comparable to a Slimbook laptop so it's no wonder that compatibility was quite good there. The issue was more down to how it plays with switching operating systems I guess.

[@KashitoTsuki]

I was wondering why my secondary pc experienced a BSOD. Now I know why.

[@bejoalan]

I also didn't know it until evening. And I'm using windows 11 pro

[@IVaruos]

I think something like this would be very rare, due to the worst thing (so called) linux know for, TheFragmentation.

[@adnanalam6201]

Back in April, Crowdstrike broke debian system 😂

[@MichaelNROH]

Not just Debian

[@GapRecordingsNamibia]

The problem is, that Microsoft gave Crowd Strike backend access to the kernel... Not only that, Crowd Strikes update ignored any N1 and N2 policies and borked both those systems instead of just the N2 systems.... If they did not have backend access and if the update were first tested then this would not have happened, therefore MS IS just as much to blame. Now, here is my question...... To whom else have they given kernel access....? Because not one single anti virus will be able to stop a kernel level update from breaking anything... Linux users know this better than anyone else...... Windows Copilot/ Recall, has cured me of Windows, what I can't use on Linux/ fedora I now just do without.

[@MichaelNROH]

Microsoft is obligated to allow kernel access due to monopoly restrictions.

[@rahulrajan33]

Codec not supported: VLC could not decode the format "hevc" (MPEG-H Part2/HEVC (H.265)) . How to solve this. gnom fedora 40

[@buneyecat]

Use arch

[@rahulrajan33]

@@buneyecat is that an application?

[@hsnbrky]

They shouldn't let other companies auto-update computers without them approving, this is just basic sense

[@prakhars962]

That is how critical updates are pushed to PCs in organisations. Microsoft doesn't need to approve anything.

[@MichaelNROH]

It doesn't make sense though. If you pay for a service that should keep your PCs safe no matter what, you don't expect to do work yourself

[@hsnbrky]

@@prakhars962 then outages like this happens and world loses millions and maybe billions, I don't think it is solely Microsoft's problem but they shouldn't have trusted another company with their own product

[@D.von.N]

If the system doesn't have a better resilience against third party mess up, it is partly their fault. Microsoft ot Linux. It is absurd that the third party software can literally bring the whole industries down like this.

[@Deimos_Fresh]

It's meme culture. People quick to conclude things without first dive even a little into details. But Microsoft did brought it on themselves.

[@rabbits2345]

Also the whole WHQL signing thing is irrelevant here. The kernel module itself is signed, but reads an external file for definitions. I really dislike Microsoft too but this really isn't their fault. Crowdstrike is the one who wrote the bad update, Crowdstrike is the one who decided to push the update with zero testing. And the companies affected are the ones who gave crowdstrike ring 0 permission to their machines. Unless Microsoft bans third party kernel modules, there really aren't to blame here

[@MichaelNROH]

Yeah, I think so too. If you sell a car, and someone tempes with the engine themselves then why should you be responsible?

[@quantumangel]

You're making it sound like this was done correctly. It wasn't. That is not the case. There should have been a lot of testing, safety protocols, supervision, confirmation, safeguards and failsafes preventing such an obvious mistake.

[@atlantic_love]

Hilarious when a Linux Fanbois comes to the rescue of Microsoft.

[@petersimmons7833]

Yes, you DO install EDR protection on Linux servers. I do not work for Crowdstrike but one of their competitors. You definitely protect all platforms. And not all of us vendors expose updates to the kernel level. CRWD did not give any user the ability to defer or schedule an update. Not everyone does it that way. @MichaelNROH And if you want to see how that works sometime I can show you how it works on Linux and on Kubernetes (yes, that's a thing we do, too).

[@Zak_box]

Bro I have dyslexic lol

[@PaulG.x]

Linux would be equally as vulnerable to this kind of problem. If Linux needed antivirus software

[@kamertonaudiophileplayer847]

Every software could crash, you should know that before design OS.

[@MichaelNROH]

That's why applications shouldn't break user space. If you manufactur a car, and someone tempers with the engine and something ends up breaking, it's the fault of the one that modified something they are not supposed to

[@kamertonaudiophileplayer847]

@@MichaelNROH Right, so we can question why Microsoft approved such engine modification providing the own signature?

[@dexgaming6394]

Microsoft put too much trust into another company, and they did not get involved in any unit testing for this firmware that Crowdstrike pushed, so yes, it is still partially their fault. It was a lack of communication on both ends. Both Crowdstrike and Microsoft are responsible for this mistake.

[@JaspreetSingh-tx2hj]

The microsoft's fault was that they allowed kernel access at such level.

[@MichaelNROH]

They are required to do so, or otherwise they would have an "unfair advantage" when they utilize it themselves

[@tubeDude48]

Microshaft strikes again!

[@CecilEtienne]

It really does not matter who fault it is Microsoft or Crowdstrike, as its not a problem that affects the Linux community. The brains behind Microsoft are destroying Windows 11 all by themselves with stupid gimmicks like Recall and co-pilot.

[@iBolski]

CrowdStrike did cause an issue with Linux servers a few months back with pretty much the same issue. It just wasn't as large of an outage as the one with Microsoft Windows.

[@CecilEtienne]

@@iBolski Really, still does not change my opinion on Microsoft

[@tablettablete186]

​​@@iBolskiI am still puzzled by how they maneged to crash eBPF 😂

[@darukutsu]

who runs antivirus in kernel space anyway...

[@MichaelNROH]

You would be surprised. Kasperspky, Avira, Crowdstrike ...., basically anyone that provides fully fledged Enterprise services

[@darukutsu]

@@MichaelNROH so sad, Imagine running anticheat in kernel space like windows games like to do, similar things could happen

[@arthurrock4979]

I reinstalled Win 11 recently. As much as I'd wish to switch to Linux, because of the obvious, copying command lines off random pages on the internet, to paste in the Linux terminal with unforeseeable results is the cup of cowboy coffee I'm not into. Prefer getting the same thing done through the click of a couple of buttons ☺️. But when a polished up enough Android x86 does show up, I'll definitely ditch Windows!

[@VSR3D]

first

[@LikhitEswara]

Second