Hacker News Reader

Comment by ndesaulniers | Hacker News Reader

Yeah, didn't the US just ban Kaspersky, over fears that Kaspersky could cause such an outage (among other fears)?

Turns out our homegrown CrowdStrike was just as bad as our fears over Kaspersky were. Perhaps worse.

The Kaspersky issue could have been better handled by simply requiring divestment or by having requiring an US-appointed auditor to investigate produce reports to assuage such concerns; as was proposed in the case of Tiktok.

> over fears that Kaspersky could cause such an outage (among other fears)?

Citation? I thought it was the "other fears"; this is the first time I'm hearing accidental outages were one of the concerns.

Not GP, but the decision and reasoning is at https://public-inspection.federalregister.gov/2024-13532.pdf (I am not claiming any specific “other fears”, just linking to the source)

Thanks. Yeah, i, ii, and iii all talk about malicious events, not accidental.

Yes but any accidental outages from an entity like Kaspersky would have been considered non accidental regardless of the actual root cause. If crowdstrike was Russian, the headlines would be a bit more suspicious about yesterday's event. or if they had brought down Russian infrastructure Russia would have probably been suspicious about American involvement, even if it's just accidental.

I suspect that regardless of which country CrowdStrike is from, the question would still arise: "should we really outsource information security protection of our critical infrastructure to country X?"

Naturally, the question of malicious intent would most likely be more or less prevalent depending on whether country X is considered an adversary.

Reply on news.ycombinator.com