• conciselyverbose@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    35
    ·
    3 months ago

    Fuck Microsoft and fuck Windows.

    But if you inject hacky bullshit third party code into someone’s OS that breaks things, it’s not the OS’s fault.

    • kureta@lemmy.ml
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      2
      ·
      3 months ago

      But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn’t have certified it because they can not fully test it. If they didn’t know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn’t certify it, they would have had zero fault.

      • conciselyverbose@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        2
        ·
        3 months ago

        Certifying a driver is not an endorsement.

        It is a verification that it is legitimately from who it claims to be from. Microsoft has zero fault, period.

        • kureta@lemmy.ml
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          3
          ·
          3 months ago

          The Windows Hardware Certification program (formerly Windows Hardware Quality Labs Testing, WHQL Testing, or Windows Logo Testing) is Microsoft’s testing process which involves running a series of tests on third-party device drivers, and then submitting the log files from these tests to Microsoft for review. The procedure may also include Microsoft running their own tests on a wide range of equipment, such as different hardware and different Microsoft Windows editions.

          • sandalbucket@lemmy.world
            link
            fedilink
            English
            arrow-up
            7
            arrow-down
            1
            ·
            edit-2
            3 months ago

            For the Nth time, crowdstrike circumvented the testing process

            Edit: this is not to say that cs didn’t have to in order to provide their services, nor is this to say that ms didn’t know about the circumvention and/or delegate testing of config files to CS. I’ll take any opportunity to rag on MS, but in this case it is entirely on CS.

        • umami_wasabi@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          3 months ago

          I had a read about the WHQL (which I assumes what certified means). It uses the Windows HLK to perform a series of tests, which submited to Microsoft, and only then the driver will be signed.

          While certification isn’t endorsement, the testing and the resulting certification implies basic compatibility and reliability. And causing bootloops and BSODs is anywhere but close to “basic compatibility and reliability.”

          • punkfungus@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            8
            ·
            3 months ago

            Crowdstrike bypassed WHQL because the update was not to the driver, it was to a configuration file that then gets ingested by the driver. It’s deliberate so they can push out updates for developing threats without being slowed down by the WHQL process.

            And that means when they decide to just send it on a Friday with a buggy config file, nobody is responsible but Crowdstrike.