It’s ironic that Crowdstrike could be suffering reputational damage due to a failure mode they didn’t realize existed in the services provided by a vendor they hired to protect them from reputational damage.

Maybe this will give them some empathy for their users who bought their services to protect their infrastructure.

You don't need empathy when you have a captive market. I'm afraid we're about to enter the "lol fuck you, what're you gonna do, leave?" stage of this organization.

Crowdstrike has several competitors, CarbonBlack, McAfee, Sophos, PaloAlto, etc.

Sure, they're all equal shades of shitty, but that's a different issue.

> Sure, they're all equal shades of shitty, but that's a different issue.

You can choose which digital shotgun is strapped to your organizational forehead.

I’ll take several different shotguns each strapped to a different limb please.

For what it's worth, McAfee is now called Trellix, and they now have what used to be called FireEye in their product line too.

> It’s ironic that Crowdstrike could be suffering reputational damage due to a failure mode they didn’t realize existed in the services provided by a vendor they hired to protect them from reputational damage.

If you spend enough time around VC's it becomes difficult to imagine how this doesn't happen more often. Many times companies grow too quickly for a clearly seasoned veteran of the market to get a chance to take the wheel. Combine this with "nobody ever got fired for purchasing IBM" and you get a perfect storm for taking out the IT infrastructure for an entire culture—all you need is a majoritarian marketshare and you can take out an entire people.

I think it's going to shift. Airlines in particular are probably going to decide that they can't afford to take another hit like this, and come up with a way to limit the damage if a software update (even from Microsoft) is broken, and come up with a way to test updates before pushing them to all devices.

> come up with a way to test updates before pushing them to all devices

This is SOP for plenty of purchasers already.

Some orgs just don't have the ability to build processes like that.

Ah, got it. So instead they'll just keep doing what they were already doing for half their systems: Keeping them without updates for decades. Those terminals survived, afterall.

I think the leaders of Crowdstrike should be considered clearly seasoned veterans. George Kurtz was high up at McAfee. But maybe Cathleen Anderson is a little new to the chief of legal role.

Okay, well done, it's hilarious how perfectly this works for both the parent comment and the CrowdStrike bug.

Where they may have messed up is with the use of crowdstrike's branding. I've worked for a company that had a near 100% success rate with taking over domains that used their branding. Not just taking down the site, but taking ownership of the whole domain.

Were any of those success for violation of copyright or trademark when used in parody? I don't know if it would hold up, or how long it would even be between a domain registrar handing it over and having a day in court, but there does seem to be a good case for this being a protected use of CrowdStrike's protected branding.

Untied.com lasted for a a really long time, but did eventually get taken down based on copyright.

https://en.wikipedia.org/wiki/Untied.com

That ruling is only relevant if the operator of clownstrike.lol is in Canada. The US in particular has much better protections for parody than most countries.

Yeah, there were a few. I believe they had to demonstrate that there was a risk that a customer could be misled or something.

Trademark is about protecting customers not for companies to protect their image.

Sorry, do you mean morally, by intent/design or legally?

Based on how well CrowdStrike has managed their response to date, this is a plausible scenario.

> I wasn't aware they file DMCA requests on behalf of companies... that seems off brand for them.

CSC is a well know high value domain registrar. Similar to MarkMonitor. I'm not surprised CSC does brand protection, also similar to MarkMonitor.

When I was at an employer that became a MarkMonitor customer, we didn't have enough domain business to meet the minimum spend, so we started using the Brand Protection "for free". Sometimes they have a hair trigger, we had our own accessory apps taken down occasionally. ¯\_(ツ)_/¯

Previous registrar was NetworkSolutions, lol; they had a customer service agent get phished, and the phishermen set new NS records for several domains, including ours. Major PITA.

Have used CSC for domain / brand protection. They offer a reputable service in this space, but i must admit, i developed the view that CSC much be a surreal place to work - i just couldn't figure out what/how/why motivates people to their mission. [obv, employee compensation]

I actually thought CSC was a parody website ... it just seems a bunch of buzzword fluff and no products. Just "solutions" which at other companies is usually code for "we don't actually have anything to sell".

Many (or most, or nearly all?) YC companies use CSC as their registered agent in Delaware if they’re incorporated as a C-corp.

Reminds me of that time when Mike Bloomberg's lawyers preemptively registered 400 .nyc domains for him, apparently without his knowledge, many of which are hilariously negative (MikeIsTooShort.nyc, MikeBloombergIsADweeb.nyc, GetALifeMike.nyc etc.):

https://www.huffpost.com/entry/michael-bloomberg-nyc-domain-...

I bet that brainstorming session was a blast

So, Mike, tell us, your lawyers, what slur cuts the deepest so that we may register it in public to protect you . . .

“Okay, 1 down and 399 to go”

> Seems to be having the opposite effect for Crowdstrike considering they paid to have their brand "protected" and now this guy's site is getting lots of traffic!

Streissand Effect.

s/ss/s/

That was fun.

a trademark claim is not DMCA, copyright only.

and what is shown on the page is Cloudflare boilerplate about DMCA, not Crowdstrike.

if Crowdstrike did use the DMCA form as a way of getting attention, that still serves as "notice" of the trademark infringement which Clownstrike has graciously acknowledged receipt of

I am quite certain that CSC won't proactively send Cease and Desist/takedown notices without first confirming with the customer that they want it done.

Someone at CrowdStike had to say "Yes, send the takedown for this".

I base this on prior experience working at places which used CSC brand protection (among other services)

Lol they actually registered clownstrike.com and have it redirect to crowdstrike.com.

https://who.is/whois/clownstrike.com

Underrated. It almost looks like self-flagellation.

They also apparently own the clownstrike.com domain [0] and this is since 2012, crowdstrike itself exists since 2011, so they must have hired them since close to the beginning. But could be that now they are probed to do damage control after the incident (though as always this tactic tends to disperse more damage than control it).

[0] https://www.whois.com/whois/clownstrike.com