Hacker News Reader

Comment by timr | Hacker News Reader

Author has it exactly backwards. Crowdstrike is installed on a huge number of corporate machines because of rules that have been imposed from above. Probably the #1 reason IT departments install the stuff is because it automates compliance for various cookie-cutter security standards.

So now, instead of having to think through your threat posture and be smart, you can deploy your magical unicorn AI software and have safe harbor ("I followed the industry best-practices!"). Just ignore the fact that said software is exporting a big juicy attack vector, wherein a third-party randomly dumps kernel-level updates on you, without your oversight, testing or permission.

What could go wrong?

View on HN

You seem to have missed the message. I am saying that we should impose rules on ourselves so that we don't have rules imposed on us from above.

Rules from above and rules by us should be in different galaxies as far as how well they work.

Who is going to set these rules we impose on ourselves?

Us, if we are smart.

The things I linked to are ideas. Others will have ideas too. Let's come to a consensus about them.

Requiring crowdstrike or similar to be able to do business isn't a requirement from government, it is from exactly this industry consensus where business, insurance, etc, gets consulting advice on what best practices exist and should be required.

We have to do precisely what we've done because it isn't working?

Physicians were not smart. They had licensing and liability imposed on them after quacks killed too many people.

Civil engineers were not smart. They had licensing and liability imposed on them after bridges fell, dams burst, buildings collapsed, killing many people.

Software developers will not be smart either. They will cry about not wanting liability and make accusations of gatekeeping until something bad enough happens (Crowdstrike isn't it; not enough people died as a direct consequence) and licensing and liability is forced on developers.

And, to echo sentiments voiced by other replies, the anti-government hyperbole is more kooky than persuasive.

Thank you for your comment. I agree that software developers won't be smart.

> And, to echo sentiments voiced by other replies, the anti-government hyperbole is more kooky than persuasive.

I am serious about it, not hyberbolic, but I will plan to leave it out of future stuff about this.

I didn't miss the message. Who is "us", exactly? What does that look like, in practice, if not something like SOC2 or ISO 27000?

I mean...maybe you're suggesting that Crowdstrike should have followed some as-yet-unknown standard for deploying software. But if so, it's the same problem -- we'll have butt-covering compliance checklists for software development now, applied thoughtlessly by consultants promising safe harbor. Turtles all the way down.

Reply on news.ycombinator.com