News for hackers. Stuff that matters.
Re:Initial details about why CrowdStrike's CSAgent.sys crashed by Sakos on Sunday July 21, 2024 @04:12AM (#41023395)
I can't decide what's more damning. The fact that there was effectively no error/failure handling or this:

> Note "channel updates ...bypassed client's staging controls and was rolled out to everyone regardless"

> A few IT folks who had set the CS policy to ignore latest version confirmed this was, ya, bypassed, as this was "content" update (vs. a version update)

If your content updates can break clients, they should not be able to bypass staging controls or policies.

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by vladvasiliu on Sunday July 21, 2024 @04:42AM (#41023489)
The way I understand it, the policy the users can configure are about "agent versions". I don't think there's a setting for "content versions" you can toggle.
Re:Initial details about why CrowdStrike's CSAgent.sys crashed by sateesh on Sunday July 21, 2024 @06:18AM (#41023940)
Maybe there isn't a switch that says "content version",but from end user perspective it is a new version. Whether it was a content change, or just a fix for typo in documentation (say) the change being pushed is different than what currently exists.And for the end user the configuration implies that they have a chance to decide whether to accept any new change being pushed or not.
Re:Initial details about why CrowdStrike's CSAgent.sys crashed by SoftTalker on Sunday July 21, 2024 @12:00PM (#41025990)
> If your content updates can break clients

This is going to be what most customers did not realize. I'm sure Crowdstrike assured them that content updates were completely safe "it's not a change to the software" etc.

Well they know differently now.