|
jochance wrote: Maybe we need a chip that is segregated and on it runs the stuff we don't want to run in the kernel but also do want.
And who gets to decide what runs on that ultra-secure chip? I trust that you see the problem.
Any time you allow arbitrary vendors to install stuff in kernel mode, you invite the kind of problem caused by CrowdStrike. Frankly, I'm surprised it hasn't happened before this. This is not to say that Microsoft is perfect in this regard, but limiting kernel access to Microsoft's code would at least reduce the threat surface somewhat.
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
I was thinking more that it would only have access to a subset of RAM shared with the OS and understood by the OS to be shared with it along with some other constraints about how it is wired and what it can talk to.
I think the difference of MSFT locking their kernel down or not is marginal. For one, I don't think it really can be locked down when people control the hardware. At best, it would only raise the bar for playing in the kernel.
Maybe people would eschew products that still injected their bits into the kernel? I don't think so though.
|
|
|
|
|
Kent Sharkey wrote: Who let the security vendors into the kernel in the first place?
Not sure about "in the first place", but back in the Vista x64 timeframe, MS were planning to lock them out of the kernel. They complained loudly, and forced MS to capitulate.
Microsoft Opening Up Vista Kernel To Security Vendors | CRN[^]
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
That would have been the only good Vista feature 
TTFN - Kent
|
|
|
|
|
Kent Sharkey wrote: Who let the security vendors into the kernel in the first place?
Microsoft, at the insistence of the EU. This is part of a 2009 anti-trust settlement between Microsoft and the European Commission. It's time for Microsoft to bite the bullet and build out an API for security firms and then force them to use it, including their own security software. This will also meet the letter of that settlement. The big problem is the security firms will scream bloody murder that Microsoft is being anti-competitive by doing this.
Remember when MS was working on Vista - MS wanted to block access to the kernel and Symantec (Norton), McAfee, Panda Antivirus, Kaspersky, and every other AV vendor went beserk because they claimed they needed this access to "secure" Windows.
As for the Cloudflare CEO, he can go pound sand - OS level security trumps his ![Elephant | [mastadon]](https://www.codeproject.com/script/Forums/Images/elephant.gif) profits.
|
|
|
|
|
What they should call is for better quality tests before rolling out and using the people as beta (or even alpha) testers.
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Microsoft, to give them their due, have a few "rings" of users:
- Insiders
- Limited-release Home users
- Home users
- Limited-release Pro users
- Pro users
- Enterprise users
CrowdStrike just released their stuff to everyone, without a limited release of any sort. When things went belly up, they had no mitigation plan other than "disable our service". This is not what I expect from purveyors of a critical service.
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
Daniel Pfeffer wrote: This is not what I expect from purveyors of a critical service.
Nor what I expect, but let see how severe will be the punishment.
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
I expect that many large, deep-pocketed organizations will be suing CrowdStrike for damages. This could easily force them into bankruptcy. While the cases are proceeding, it will affect the share price, thereby punishing the shareholders (including the CEO and other officers).It will also make any potential purchasers of the company think twice, so bailing out will become more difficult.
On the consumer level, the best punishment would be organizations migrating to other security providers.
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
But the rock still has to be sent back to Earth for extensive testing. "Are physical forces alone at work there, or has evolution begotten something more complex, something not unakin to what we know on Earth as life?"
|
|
|
|
|
Article wrote: But the rock still has to be sent back to Earth for extensive testing.
hehehe[^]
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
The service is a temporary prototype limited to 10,000 testers for now. Find all the stuff it can imagine
|
|
|
|
|
Kent Sharkey wrote: Find all the stuff it can imagine regurgitate
FTFY
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Following licensing changes, 86% of users head for the door. Coincidence? Amazing what happens when you try to squeeze your customers dry
|
|
|
|
|
Where's Captain Obvious when you need him?
Obviously unavailable.
I’ve given up trying to be calm. However, I am open to feeling slightly less agitated.
I’m begging you for the benefit of everyone, don’t be STUPID.
|
|
|
|
|
Article wrote: 86% of users head for the door
I am gladly surprised.
Looking at other news and how the world goes today, I would have expected less common sense
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
I’m going to tease apart the difference between clean code, as described in Uncle Bob’s book, and clean code, a generic term of praise used in engineering contexts for decades. Sanitized code?
|
|
|
|
|
Clean code is for me only relevant for us, the people.
Doing benchmarks to test performance of "clean" code is not correct, that is efficience not cleanliness
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
The achievement is noteworthy because AI systems don't usually fare well with complex math challenges. It did so well because of all the extra toes it added to itself
|
|
|
|
|
Article wrote: AI systems don't usually fare well with complex math challenges.
I do not think the maths are the problem, but the description of the exercise.
A good spec is 25% (or more) of the work.
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
OpenAI might need another round of funding to remain afloat. Are they using their AI to do their finances?
|
|
|
|
|
Because people read the Shock study above about how well AI is improving everyone's productivity?
Kent, don't you wish you could group these stories better.
I’ve given up trying to be calm. However, I am open to feeling slightly less agitated.
I’m begging you for the benefit of everyone, don’t be STUPID.
|
|
|
|
|
MarkTJohnson wrote: Kent, don't you wish you could group these stories better.
I do indeed. Maybe I'll ask Chris for an early present this year.
TTFN - Kent
|
|
|
|
|
Kent Sharkey wrote: Are they using their AI to do their finances?
We should try to let AI run some companies, it can't be that worse
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Rust’s new LazyCell and LazyLock types delay the initialization of their data until first access. Ranged patterns also get attention in the latest update to the language. I'm part of Rust now?
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
