This week’s issue is entirely focused on the CrowdStrike incident: more details on what happened, analysis, and learnings. I’ll be back next week with a selection of all of the great stuff you folks have been writing while I’ve been off on vacation for the past two weeks—my RSS reader is packed with awesomeness!
A message from our sponsor, FireHydrant:
Migrate off of PagerDuty, save money, and then have all of your configuration exported as Terraform modules? We did that. We know one of the hardest parts of leaving a legacy tool is the old configuration, that’s why we dedicated time to build the Signals migrator, making it easy to switch.
https://firehydrant.com/blog/speedrun-to-signals-automated-migrations-are-here/
This week, CrowdStrike posted quite a bit more detail about what happened on July 19. The short of it seems to be an argument count mismatch, but as with any incident of this sort, there are multiple contributing factors.
The report also continues the conversation about the use of kernel mode in a product such as this, amounting to a public conversation with Microsoft that is intriguing to watch from the outside.
CrowdStrike
This article has some interesting details about antitrust regulations(!) related to security vendors running code in kernel mode. There’s also an intriguing story of a very similar crash on Linux endpoints running CrowdStrike’s Falcon.
Note: this one is from a couple of weeks ago and some of its conjectures don’t quite line up with details that have been released in the interim.
Gergely Orosz
While it mentions the CrowdStrike incident only in vague terms, this article discusses why slowly rolling out updates isn’t a universal solution and can bring its own problems.
Chris Siebenmann
Some thoughts on staged rollouts and the CrowdStrike outage:
The notion we tried to get known far and wide was “nothing goes everywhere at once”.
Note that this post was published before CrowdStrike’s RCA which subsequently confirmed that their channel file updates were not deployed through staged rollouts.
rachelbythebay
[…] there may be risks in your system that haven’t manifested as minor outages.
Jumping off from the CrowdStrike incident, this one asks us to look for reliability problems in parts of our infrastructure that we’ve grown to trust.
Lorin Hochstein
While CrowdStrike’s RCA has quite a bit of technical detail, this post reminds us that we need a lot more context to really understand how an incident came to be.
Lorin Hochstein
In the future, computers will not crash due to bad software updates, even those updates that involve kernel code. In the future, these updates will push eBPF code.
I didn’t realize that Microsoft is working on eBPF for Windows.
Brendan Gregg
This post isn’t about what Crowdstrike should have done. Instead, I use the resources to provide context and takeaways we can apply to our teams and organizations.
Bob Walker — Octopus Deploy
