Hacker News Reader

> I haven't seen a postmortem or RCA from Crowdstrike yet.

I got you! It’s relatively new, published four days ago. The relevant section is called “what went wrong and why”:

https://www.crowdstrike.com/falcon-content-update-remediatio...

There’s a lot of fluff, that boils down to “we tested the code in march”, “we did not test subsequently”, “we validate the content we push”, and “there was a defect in the content validation process”

And it seems to confirm, although not completely explicit, that there was _not_ a canary facility in place.

Correct. It sounds like they test changes to code in such a facilty, but “content” is only validated by a parser. Mcafee did something similar a decade ago.

It’s a hard problem - the whole point of Crowdstrike is to quickly respond to threats. (And they are very good at it) So you want time to market for marginal changes to be very fast. Normally I’d give them the benefit of the doubt, but their arrogance and poor response triggers my spidey-sense.

Thank you! I'm surprised this didn't get more coverage in my social media sphere. I'm still seeing memes and jokes.

Reply on news.ycombinator.com