Yep. We can't migrate our workstations to Ubuntu 24.04 because Crowdstrikes falc...

pmontra · 2024-07-19T09:51:27 1721382687

Why would you use Crowdstrike on Ubuntu? Is because of a real security concern, or abiding to regulations (thou shalt have an antivirus) or else?

thyrsus · 2024-07-19T10:43:04 1721385784

I was given to understand that Crowdstrike provided some protection from unvetted export of data. I'm not sure that data would be useful without the rare domain expertise to use it, but I wasn't shown the risk analysis. And then someone else demands and gets ssh access to GitHub. Sigh.

simfoo · 2024-07-19T10:04:15 1721383455

Ask my IT dep. AFAIK it's audit related, safety-critical software

jonathanlydall · 2024-07-19T10:30:17 1721385017

I think "compliance" would be a better word to use that "safety" when it comes to a lot of "security" software on computers.

And I bring up the distinction because while compliance is "sometimes" about safety, it's also very often about KPIs of particular individuals or due to imaginary liability for having not researched every possible "compliance" checkbox conceivable and making sure it's been checked.

Some computer security software is completely out of hand because its primary purpose is to have the appearance of effectiveness for the exec whose job is to tick off as many safety checkboxes as they can find, as opposed to being actually pragmatically effective.

If the same methodologies were applied to car safety, cars would be so weighed down by safety features, that they wouldn't be able to go faster than 40km/h.

slow_typist · 2024-07-19T10:25:57 1721384757

Just to be safe, of course! In my org they try to rollout sentinel one on every ‘endpoint’ regardless of operating system.

actionfromafar · 2024-07-19T09:01:54 1721379714

Probably only a violation if you distribute the linked result. Not if you only install it.

saagarjha · 2024-07-19T09:14:06 1721380446

How would you install it without them distributing it?

tpush · 2024-07-19T11:07:27 1721387247

They mean distributing Linux + the module together. Like e.g. shipping the Nvidia kernel module alone is fine, but shipping a Linux distro with that module preinstalled is not fine.

diffeomorphism · 2024-07-19T10:45:16 1721385916

Two different "it". As an analogy: selling pizza Hawaii is dicey, but you can sell pineapple slices and customers can add those to their pizza themselves.

qwertox · 2024-07-19T10:46:03 1721385963

> We can't migrate our workstations to Ubuntu 24.04 because Crowdstrikes

Should you upgrade before 24.04.1 is released? It's scheduled for August 15.

CoastalCoder · 2024-07-19T13:02:39 1721394159

IIRC, about a 12-18 months ago CrowdStrike was recruiting for a development with eBPF skills.

rkangel · 2024-07-19T09:21:16 1721380876

The generally accepted (but not well tested) legal position is that it's ok to have a proprietary kernel module that is dynamically loaded.

You can, for instance, ask a running kernel if it is "tainted" by having loaded a non-GPL module.

vbezhenar · 2024-07-19T10:51:02 1721386262

Last time I dealt with HP, I had to use their fakeraid proprietary kernel module which "tainted" the kernel. Of course they never open-sourced it. I guess it's not necessary.

immibis · 2024-07-19T09:37:11 1721381831

GPL exported symbols are the ones that are thought to be so tightly coupled to the kernel implementation that if you are using them, you are writing a derivative work of the kernel.

simfoo · 2024-07-19T10:03:33 1721383413

Yeah that was also my understanding, and I can't imagine a av module able to intercept filesystem and syscalls to be only using non-core symbols. But of course you never know without decompiling the module

yjftsjthsd-h · 2024-07-19T14:21:23 1721398883

> and I can't imagine a av module able to intercept filesystem and syscalls to be only using non-core symbols.

I can, considering that you can do that from user space using strace. Or ebpf which is probably the actual right way to do this kind of thing.