this post was submitted on 20 Jul 2024
100 points (89.1% liked)

Technology

59287 readers
5184 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
100
To what extent, if at all, would have CrowdStrike's faulty update have been easier to deal with with an immutable distro? (lemmy.ml)
submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]
51 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 14 points 3 months ago (1 children)

If the sensor was using eBPF (as any modern sensor on Linux should) then the faulty update would have made the sensor crash, but the system would still be stable. But CrowdStrike has a long history of using stupid forms of integration, so I wouldn't put it past them to also load a kernel module that fucks things up unless it's blacklisted in the bootloader. Fortunately that kind of recovery is, if not routine, at least well documented and standardized.

[–] [email protected] 2 points 3 months ago (1 children)

I did hear that one of their newer versions does use eBPF, but I haven't even remotely looked into it.

https://nondeterministic.computer/@mjg59/112816011370924959

[–] [email protected] 1 points 3 months ago

They do have a bpf sensor. It's still shite, managing to periodically peg a CPU core on an idle system. They just lifted and shifted their legacy code into the bpf sensor, they don't actually make good use of eBPF capabilities.