ADVERTISEMENT

Crowdstrike - F you

So how does Unix look for suspicious behavior? I know Unix gets hacked, some of those massive breaches have to be Unix because Windows servers aren't ubiquitous.

I don't claim to know much, but my understanding is that the *nix servers that get compromised are nearly universally outdated and unpatched. Pure dereliction on the part of their administrators. The "vulnerabilities" the Redmond crowd loves to tout are nearly always proof of concept (found by those who just love to poke and prod and find stuff, and they can, since it's open source), which are then dutifully patched and updates are offered up before anything happens. True zero days are extremely rare. On the client side, there's really no such thing as "anti-virus" running resident. For a client to be compromised it would require the user to escalate to root and grant the malignant payload access.
 
Last edited:
I don't claim to know much, but my understanding is that the *nix servers that get compromised are nearly universally outdated and unpatched. Pure dereliction on the part of their administrators. The "vulnerabilities" the Redmond crowd loves the tout are nearly always proof of concept (found by those who just love to poke and prod and find stuff, and they can, since it's open source), which are then dutifully patched and updates are offered up before anything happens. True zero days are extremely rare. On the client side, there's really no such thing as "anti-virus" running resident. For a client to be compromised it would require the user to escalate to root and grant the malignant payload access.
But if I wanted data off of you Unix box with non-Microsoft SQL, I do not need root. If your website lets me send an escape character, I can run commands on your SQL. So you need something capable of looking for attacks like that. Or capable of knowing Mark should not be requesting the volume of the type of data he is.
 
But if I wanted data off of you Unix box with non-Microsoft SQL, I do not need root. If your website lets me send an escape character, I can run commands on your SQL. So you need something capable of looking for attacks like that. Or capable of knowing Mark should not be requesting the volume of the type of data he is.

Now you're over my head.

Suffice it to say that it's damn near impossible to compromise a Linux client, and any reports of such require active participation by the user. If anything even remotely close to this Crowdstrike FUBAR had ever occurred in the Linux world I would have heard about it. I haven't.
 
No. This was on Crowdstike alone. They f’ed up, and it was pretty basic stuff.

I understand that this was a Crowdstrike failure, not MSFT. But the reason CS even exists is because the world runs in a MSFT monculture. That monoculture is the single failure point.
 
No. This was on Crowdstike alone. They f’ed up, and it was pretty basic stuff.
Just curious as a non coder.
Do you all have to remember to put 8 zeros, or 7 or 9... does the world explode if you forget one, or add an extra?

That shit fascinates me. (not being a smart ass, serious question).
 

FIFY

tenor.gif
 
This one may be different. Customer losses from this will be in the billions.
That's definitely a possibility but I'm betting it won't be the case in the near future. However, I think it could hurt them in the long run. Obviously they threw an update out there without rigorous testing. I don't like it when some phones won't let you delay updates and the are automatically installed. I'd rather wait about a week after the updates are released to see if problems arise.
 
  • Like
Reactions: UncleMark
Yeah, how that update got released is going to be hard to explain.
I think Biden issued an executive order for it to be released. 🤣 🤣 🤣 Seriously, I have thought the same thing but I think a lot of companies do that hoping that the bugs in the release won't be too detrimental. You would think that they would release it in waves and have some time between waves to see if problems pop up.
 
  • Haha
Reactions: Joe_Hoopsier
I view computer commerce as a public utility. These pricks do not have the right to make mistakes. They should go to jail.
If that's the case, then it would be a lawyer's dream. And insurance, since everyone in IT would be required to have liability insurance.

Bad idea. Let the market decide.
 
Its like electricity - can’t run business or have a life without it - gotta bid for rights through public service commissions to run cable/e-crap.

So if you want access, you should be required to put up like a utility.
In your electricity metaphor, that ecommerce business is no different than a store or factory tied into the electrical grid.
 
  • Like
Reactions: DANC and UncleMark

“Compare any consumer product today with its 1990 equivalent, and you’ll often find that either the quality has risen dramatically (cars) or the price has fallen precipitously (clothes). In the case of televisions and many other products, it’s both.
With the exception of Samsung refrigerators, LG front load washers, and Rheem water heaters, I agree with point about higher quality.
 
With the exception of Samsung refrigerators, LG front load washers, and Rheem water heaters, I agree with point about higher quality.
Does anyone make decent kitchen appliances and washers and dryers anymore?

I paid extra to buy a Speed Queen clothes washer a few years ago. No electronics whatsoever. It was worth the extra $$$.
 
I can't figure out why anyone would want a frong-loading clothes washer. Enlighten me.
Wifey will tell you less water, electricity and detergent needed. I'll tell you it's because when it's my turn to do laundry, it holds a shitload of clothes and it doesn't take all day to do multiple loads. Plus it's easy on the down bags and quilts.
 
  • Like
Reactions: DANC and 76-1
ADVERTISEMENT
ADVERTISEMENT