Apple Turned the CrowdStrike BSOD Issue Into an Anti-PC Ad (theverge.com) 103
An anonymous reader shares a report: It's been a while since Apple last mocked Windows security, but the iPhone maker has just released an ad that hits Windows hard. The eight-minute commercial pokes fun at the CrowdStrike Blue Screen of Death (BSOD) issue that took down millions of Windows machines last year.
Apple's ad follows The Underdogs, a fictional company that's about to attend a trade show, before a PC outage causes chaos and a Blue Screen of Death shuts down machines at the convention. If it wasn't clear Apple was mocking the infamous CrowdStrike incident, an IT expert appears in the middle of the ad and starts discussing kernel-level functionality, the core part of an operating system that has unrestricted access to system memory and hardware.
Apple's ad follows The Underdogs, a fictional company that's about to attend a trade show, before a PC outage causes chaos and a Blue Screen of Death shuts down machines at the convention. If it wasn't clear Apple was mocking the infamous CrowdStrike incident, an IT expert appears in the middle of the ad and starts discussing kernel-level functionality, the core part of an operating system that has unrestricted access to system memory and hardware.
Matthew 7:3 (Score:2)
Crowdstrike supports MacOS endpoints as well so there's no reason this couldn't happen on a Mac.
That said, who watches an eight minute commercial? At a certain point this passes from advertising into propaganda.
Re:Matthew 7:3 (Score:4, Interesting)
They specifically say why the kernel does not (and does not need to) give the same low level access for third party scanners.
Interestingly macos is on a read-only volume
Re: (Score:1)
Indeed they don't, and you don't need to on Windows either. It just so happened that Windows wasn't quite as walled gardenish as Apple protecting you from using your computer.
Sidenote: know what other systems Crowdstrike has a history of taking down hard at boot? ... Linux / Unix. Do they suck too?
Re: Matthew 7:3 (Score:2, Informative)
The failures on Linux could be repaired remotely, unlike the infamous failure that took down all of those windows machines. Not surprised you're trying to equate the failures, though.
Re: (Score:2)
False. They caused a kernel panic during boot on loading the epbm module. The only way to fix this remotely was on systems that Linux happened to actually be running on, given the benefit of having BMS and being able to open a *local* terminal over the network.
Not surprised you once again have no idea what you were talking about.
Re: (Score:2)
Yes there is, because MacOS is an immutable distro, so you don't get to modify the kernel.
Immutible linux distros were also immune, but mutible distros (most of the mainstream ones) were not.
Re: (Score:2)
Not quite. On Linux, crowdstrike uses the ebpf mechanism to do its work, not deep, pre-boot kernel hooks like it uses on Windows.
Re: (Score:3)
Crowdstrike managed to cause Linux kernel panics and boot problems before the Windows issue. RedHat explicitly issued a customer notification about the EBPF module being the cause.
Also Windows supported EBPF but Crowdstrike simply didn't use it.
Re: (Score:2)
Weakening PatchGuard in x86-64 versions of Windows to make the job of AV vendors easier was a terrible mistake by Microsoft, it allowed AV vendors to keep letting themselves in the kernel
Re: (Score:2)
Weakening PatchGuard in x86-64 versions of Windows to make the job of AV vendors easier was a terrible mistake by Microsoft, it allowed AV vendors to keep letting themselves in the kernel (as they've been doing since Windows NT 4.0), with disastrous consequences (the Crowdstrike incident, for example).
The problem for Microsoft is that they are not only the OS vendor, they are also a vendor of paid AV products. Microsoft's AV products make Microsoft a competitor in the software security market against third-party AV vendors.
Due to anti-trust concerns, Microsoft could not really just prevent third-party AV vendors out of the kernel while at the same time keeping said access for their own product, so the decision was either everyone out - themselves included - or everyone in.
Apple didn't have the same anti-
Re: (Score:2)
Re: (Score:2)
This is btw the reason why you shouldn't let third parties into the kernel.
To be clear, this is why you *the user* shouldn't let third parties into the kernel. The Apple approach, and the way Microsoft is going of taking that option away from your control entirely and stepping yet further into territory of what you can do with your computer is a cure worse than the disease.
Sidenote: I wrote a utility to read out motherboard information using librehardware monitor and transmit it to a controller over USB. Microsoft just marked that code, code that I compiled and vetted myself as ma
Re: (Score:2)
> Crowdstrike supports MacOS endpoints as well so there's no reason this couldn't happen on a Mac.
yes there is: 3rd party kernel extensions are not allowed on mac, so to get the machine into an unbootable state is quite unlikely.
All security software can do on macos is hook itself into apple's APIs (System extensions and Network extensions in Apple nomenclature), which provide it with events.
From what I heard, MS will be going the same way long-haul.
Think fanotify and nfqueue APIs on Linux.
Re: (Score:2)
However... It's still possible for Crowdstrike to do something stupid that brings a system to its needs.
The software is able to block a file from being opened or read, for example. Now what happens if Crowdstrike suddenly detects _EVERY_ file as malicious and starts preventing the system reading any files at all? For example.. the Browser.. the Windows manager.. the Launcher, Desktop, etc.. Any programs that have to run in order for the user to successfully log in and use their system.
Re: (Score:2)
Crowdstrike also supports Linux. Yet there is no way this could happen on Linux. Why? Because Crowdstrike uses a sane design on Linux via the eBPF. No idea what they do on OS-X, but your statement is without insight.
Re:Matthew 7:3 (Score:4, Informative)
Crowdstrike has taken down linux systems at least twice in the past that I remember. This is a link to the most recent event.
https://www.theregister.com/20... [theregister.com]
Re: (Score:1)
Yes. Bit not ion the same way they took down Windows. Details matter very much. On Linux, you had a few minutes after boot before the crash. That allows automatic fixes. On Windows, no login was possible. And if you had done _any_ research, you would know that.
Re: (Score:2)
Crowdstrike literally caused this to happen on Linux multiple times in the past. RedHat even issued a notification on it telling people how to get their systems to boot again.
Also Windows supports eBPF, Crowdstrike chose not to use it.
Re: (Score:1)
I do not know where you get your information, but it is crap. On Linux you could reboot and then had a window for login. That allows automated fixing. On Windows, no login was possible.
Re: Matthew 7:3 (Score:2)
On their video: Comments are turned off. LOL!
Of course they are. Can't have opposition to the Apple Borg walled garden.
Re: Matthew 7:3 (Score:1)
Re: (Score:2)
At a certain point this passes from advertising into propaganda.
There's a difference?
I'm being serious here. I suppose some small portion of advertising avoids being propagandistic, but IMHO the vast majority of it is exactly that.
8 minutes? (Score:3)
Re: (Score:2)
Yeah, at first glance I'd suspect this is/was intended for one of their "fan" events, like WWDC.
Re: (Score:2)
Re: (Score:2)
Apple fanbois.
Re: (Score:2)
I was starting to fast forward at the 4 minute mark..
Critics, critics, critics.... (Score:1)
Cute commercial.
The concept is good, the execution is bit too awkward in spots. I would bet that we see some 30 second commercials riffing on the same themes over the next couple of months.
Re: (Score:2)
No, it was pretty cringe worthy and stupid. It insulted my intelligence, and it was 8 minutes of my life that I want back.
But... the timing on it is pretty good. Millions of people are getting notices on their Windows 10 systems this month that they're no longer supported, and they're probably going to get new computers anyway. Might as well be a Mac.
Re: Critics, critics, critics.... (Score:3)
Then you're also needing to find new end user software cause the windows programs don't run on Mac OS
Re: (Score:2)
Re: (Score:2)
The average Mac user would never be able to figure it out, much less someone who just changed operating systems and is still trying to figure out how to add their frelling printer.
Re: Critics, critics, critics.... (Score:2)
The timing of an attack ad is good, but people have short memories, so the timing of THIS ad is crap. They should have released an ad like this within a couple of weeks of when clownstroke failed.
Double standards (Score:2)
No one would be complaining if a Linux vendor released a commercial like this to promote their OS. Instead the comments here would be filled with I.T. professionals talking about the CrowdStrike event, and how all the Windows systems were dead in the water but their *nix-based ones were humming along.
Re: (Score:2, Informative)
For those who still don't get it: If an OS vendor doesn't control the kernel, the OS vendor can't prevent kernel panics, no matter how good the OS vendor's code is.
Re: (Score:2)
For those who still don't get it: If an OS vendor doesn't control the kernel, the OS vendor can't prevent kernel panics, no matter how good the OS vendor's code is.
The one that does not get it is _you_. System security is the responsibility of the system administrator. The OS vendor is just somebody that provides reasonable means and reasonable defaults (or not as in the case of Microsoft).
Re: (Score:2)
Re: Double standards (Score:2)
Clownstroke is not required for compliance, there are other tools which do what it does.
Re: (Score:2)
Also, most AV vendors on Windows (even consumer-oriented ones) do what Crowdstrike does (they let themse
Re: (Score:2)
Nonetheless, there were organizations which did drop them after their big no input validation fuckup.
Re: (Score:2)
Re: (Score:2)
They promptly moved to another AV vendor that injects their own third-party code into the kernel, which could also potentially cause a Crowdstrike-like incident in the future.
Yes, they could, if they are as incompetent as Clownstroke is, and they do not validate input to make sure it is even vaguely close to valid. That is a real problem whose likelihood we cannot evaluate because we are discussing closed source software, but one at least hopes that they learned something from the debacle.
And the administrator still doesn't have a freakin' choice but to allow that third-party code in (or get fired).
Moving the goalposts. We were talking about getting ride of Clownstroke.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Third parties don't belong in the kernel even on Linux. There IS an alternative.
That is up to you as the administrator to reject vendors who don't use the alternative and want to send you a custom kernel driver instead.
Re: (Score:2)
Re: (Score:2)
Just FYI, Compliance frameworks only call out the controls that need to be in place, they don't recommend products to fulfill those controls, that's left up to the organization.
Re: (Score:2)
Re: (Score:2)
Crowdstrike uses eBPF on Linux, so it doesn't require a third-party kernel module as far as I understand it. In other words they use a kernel-provide API to do their detection work on Linux, much like they do on macOS.
Re: (Score:2)
Re: (Score:2)
Exactly. Windows and Linux are stuck in the past by allowing third parties into the kernel.
I prefer not to have someone dictate what code I can and can't execute on my machine thanks. Allowing 3rd parties into the kernel on Linux is not a bug, it's a feature of an open ecosystem.
If you need a nanny Tim Cook is more than happy to embrace you in his loving bosom.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Those words don't go together as a sentence like you think they do. Now, if you want to talk about a mach microkernel with a userland originally derived from FreeBSD you'd make more sense. No linux involved.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Linux? Did you hit your head while climbing underneath your desk to unplug your AS400? Go take a look at FreeBSD and the fork called Darwin, that is where MacOS originally came from.
Re: (Score:2)
It isn't a fork of FreeBSD, the kernel is descended from CMU Mach, and it had a BSD userland tacked on. It definitely isn't Linux, though.
Who Is The Audience? (Score:2)
Who is the audience for an 8 minute commercial?
I'm certainly not watching it. I doubt their putting that on TV either. So, WTF?
Re: (Score:1)
Who is the audience for an 8 minute commercial?
I'm certainly not watching it. I doubt their putting that on TV either. So, WTF?
Trade shows
Re: (Score:2)
They don't need anyone to watch it. Just to talk about it.
Mission accomplished
Re: (Score:2)
Is it true that it's full of furries?
And Still... (Score:2, Informative)
Fuck Apple.
Boring (Score:2, Insightful)
And useless. MacOS is not a professional, business OS. Never has been, and never will be. If you can't, or won't, use Windows, then the only real alternative is some flavor of Linux.
Lack of information.... (Score:1)
It's almost like you missed the the other story on the front page today:
https://apple.slashdot.org/sto... [slashdot.org]
But being the smart, informed person you are, I must be mistaken.
Re: (Score:2)
First of all, that is not a front page story from today, but from a week and a half ago.
Secondly, I don't care what businesses are actually doing. if their CIOs want to be complete retards by increasing the usage of MacOS, that's on them and their companies.
Re: (Score:2)
You never actually say what's wrong with MacOS.
Re: (Score:2)
Re:Lack of information.... (Score:4, Informative)
-Upfront and repair costs
-Apple security is nowhere near as good as the average user (or seemingly the average CIO) would think it is
-Even if the Macs are easier to manage in and of themselves (they're not), they're absolutely terrible to manage in a mixed environment
-Does not play nice, if at all, with most of the rest of the hardware and software that businesses need or use
If you want a "workstation" that is easy to manage on a network, doesn't require crazy super Windows specific software, and works on any hardware the answer is Linux. Preferably, a Fedora Atomic based image customized to the employees role. Employee can choose between GNOME (if they prefer Macs) and KDE (if the prefer Windows). Easy to roll out, easy to manage, and basically impossible for the user to fuck it up in any way, and even if they somehow do it can be solved in under 10 minutes.
Re: (Score:2)
What makes something a "business OS" ?
Re: (Score:3)
How about "something that is interoperable with most of the hardware and software the enterprise uses, the ability to be centrally managed by the IT department, follows standards and conventions of the computer industry so that any user can sit down and be productive without training, and which can secure corporate digital and physical assets"? Apple doesn't hit ANY of those points. Until recently Apple products have been relegated to non-critical departments like Marketing which never touch high value
Re: (Score:2)
MacOS is a mostly POSIX compliant unix based operating system. It should work as well as linux.
Re: (Score:2)
The only nod that Apple makes to manageability is it can authenticate to an LDAP directory, no user profiles, no group policies. Won't run any of the building management or security programs that I've worked with, and won't even display typical security video correctly (probably because it's such a low frame rate). Engineering programs are flaky at best, when they'll work at all. Even using USB it won't talk to security hardware, can't plug into a wired network, has no file control equivalent to NTFS. I
Re: (Score:2)
Combination of what cusco said, and, to a lesser degree, the second half of my other reply to you.
Re: (Score:2)
It's got to be the games and other pup's Microsoft pushes down at a whim that make it a "Business OS".
I've banned Microsoft Windows from the last 3 companies and I'll continue doing it until I retire. Windows is difficult to control and protect, which is why I will always buy a macbook pro over the highest end windows dumpster fire.
Re: (Score:2)
I'd rather skip the Apple tax altogether and choose my own hardware and choose something that actually plays nicely with all other hardware - Fedora Atomic distros. I would never pay $1600-3000 for hardware that costs less than $800.
Re: (Score:2)
Just used my last mod points for the day. Here, have a personalized "TROLL" message, lovingly crafted by our artisans.
Re: (Score:2)
I haven't heard anyone refer to MacOS (OSX) as not being business class in over a decade, not since a study from around 2011-2012 proving companies pay more money to have Microsoft on their endpoints over the TCO of Macbook's. Microsoft products take more time to deploy, support, and defend than Apple products.
Re: (Score:2)
I'm not necessarily advocating *for* Microsoft either. It's what a lot of people are stuck with because a lot of businesses have custom built software that they don't feel like spending the money to try and upgrade. But I stand by my statement that Apple is not suited for business - at least not big, corporate business. Maybe it's fine in smaller businesses.
Unpopular opinion (Score:2)
The ad is cringe, but the facts are there.
Re: (Score:2)
I use a version of Linux that doesn't allow any third parties into the kernel at all, for any reason. It's completely immutable. Which is even better than anything MacOS does.
Re: (Score:3)
Re: (Score:2)
I'm using Bazzite, built by Universal Blue which is based off of Fedora Atomic Desktop. And yeah, you can't really install kernel-space drivers. I mean, technically, you *can*, but you'd have to custom build a new OS image in order to do so, and then update and reboot into it. And if you accidentally fucked up super hard in some way, you can just boot right back into the rollback before you did anything.
Re: (Score:2)
Re: (Score:1)
Linux is in fact way in the future. Immutable if you want it, temporarily mutable it you really need it, totally mutable if you're kernel hacking or similar. Neither Windows or MacOS can match all three of those points.
Re: (Score:2)
Dumb opinion, you mean. Linux does "allow" things into the kernel if the system administrator explicitly wants so. It is a very rare thing these days. Not even Crowdstrike requires that on Linux. They run via eBPF from userspace. The problem on Windows is that there are no sane in-kernel services for many things, because Microsoft does absolute minimum they think they can get away with and sometimes less. That problem is not present on Linux.
What a joke (Score:4, Interesting)
Just . . . bad. (Score:5, Interesting)
It should have been two minutes long. It should have included John Hodgman. It should have come out a least a year ago.
Infeasible to use mac for anything infrastructure (Score:4, Informative)
You'll just get screwed by the rigorous updates and deprecations not caring for the mountain of legacy software out there.
The fucked-in-the-head thing is not the "PC". (Score:1)
It is the PC running Windows.
Scathing Retort Dilbert Latestein (Score:1)
Undoing erroneous mod (Score:2)
n/t
Eight minute commercial? (Score:2)
The video is actually pretty good. (Score:2)
It tries a tad to hard to be hilarious and is obnoxious in that way but overall the whole short film does lean into the major system level difference between W1ndows and macOS. It also shows how someone might actually solve the problem by quickly switching to macOS. They cleverly plug the Mac Mini as a gateway device for this. Which it actually in reality often is.
It pushes the diversity shtick/fad a little hard (the masOS geek that saves the day is a women - because of course _she_ is), but she is exaggera
macos is sorta linux (Score:2)
OK OK OK (Score:2)
I'll switch all of the windows servers in my datacenter to macs.
How does that work?
Re: (Score:2)
Check out https://universal-blue.org/ [universal-blue.org] and their various images depending on which suits your situation more.