42 ms·

With the crowdstrike outage earlier last year it was incredible how many hidden security and kernel "experts" came out crawling from the woodwork, questioning w

With the crowdstrike outage earlier last year it was incredible how many hidden security and kernel "experts" came out crawling from the woodwork, questioning why anything needs to run in the kernel and predicting the company's demise.

milkshakes 2y ago
the experts were correct. in 2024 there are now OS APIs that provide the same observability and control with much less risk involved.
- ta1243 2y ago
  And yet crowdstrike's stock price is still 28% up on where it was 12 month ago, 46% up on 6 months ago after their crash. Sibling is right, that type of product is nothing to do with actually preventing problems, its to do with outsourcing personal risk. Same as SAAS. Nobody got fired when office 365 was down for the second day in a year, but have a 5 minute outage on your on-prem kit after 5 years and there's nasty questions to answer.
- ponty_rick 2y ago
  Pretty sure every vendor uses the kernel. There must be a reason behind none of them exclusively using the APIs.
  - milkshakes 2y ago
    yeah, it's money.
lmm 2y ago
They were correct that there is no need for it to run in the kernel. They were incorrect in thinking this would affect the company's future, because of course the sales of their product have nothing to do with its technical merit.
- spydum 2y ago
  I think you've got it half correct: sales absolutely does have to do with the technical merit. Their platform works, it's just folks overestimated the impact of a single critical defect. Nobody would pay crowdstrikes prices if it didn't stop attacks, or improve your detection chances (and I can assure you, it does, better than most platforms)
  - lmm 2y ago
    > Nobody would pay crowdstrikes prices if it didn't stop attacks, or improve your detection chances In my experience people pay because they need to tick the audit box, and it's (marginally) less terrible than their competitors. Actually preventing or detecting an attack is not really a priority.

milkshakes 2y ago

the experts were correct. in 2024 there are now OS APIs that provide the same observability and control with much less risk involved.

ta1243 2y ago
And yet crowdstrike's stock price is still 28% up on where it was 12 month ago, 46% up on 6 months ago after their crash. Sibling is right, that type of product is nothing to do with actually preventing problems, its to do with outsourcing personal risk. Same as SAAS. Nobody got fired when office 365 was down for the second day in a year, but have a 5 minute outage on your on-prem kit after 5 years and there's nasty questions to answer.
ponty_rick 2y ago
Pretty sure every vendor uses the kernel. There must be a reason behind none of them exclusively using the APIs.
- milkshakes 2y ago
  yeah, it's money.

lmm 2y ago

They were correct that there is no need for it to run in the kernel. They were incorrect in thinking this would affect the company's future, because of course the sales of their product have nothing to do with its technical merit.

spydum 2y ago
I think you've got it half correct: sales absolutely does have to do with the technical merit. Their platform works, it's just folks overestimated the impact of a single critical defect. Nobody would pay crowdstrikes prices if it didn't stop attacks, or improve your detection chances (and I can assure you, it does, better than most platforms)
- lmm 2y ago
  > Nobody would pay crowdstrikes prices if it didn't stop attacks, or improve your detection chances In my experience people pay because they need to tick the audit box, and it's (marginally) less terrible than their competitors. Actually preventing or detecting an attack is not really a priority.