this post was submitted on 19 Jul 2024
131 points (100.0% liked)

TechTakes

1436 readers
145 users here now

Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.

This is not debate club. Unless it’s amusing debate.

For actually-good tech, you want our NotAwfulTech community

founded 1 year ago
MODERATORS
 

The machines, now inaccessible, are arguably more secure than before.

you are viewing a single comment's thread
view the rest of the comments
[–] sailor_sega_saturn@awful.systems 30 points 4 months ago* (last edited 4 months ago) (28 children)

Fair warning that I'll be ranty because I hate losers talking about DEI hires.

So why is memory address 0x9c trying to be read from? Well because... programmer error.

So what happened is that the programmer forgot to check that the object it's working with isn't valid, it tried to access one of the objects member variables...

This is a huge assumption. ~~The last rumor I've read from actual cybersecurity people is that Crowdstrike's update files were corrupt~~ (update: disproven by Crowdstrike's blog post). If this is true it's likely still from programmer error at some level, but maybe not as simple as "whoopsie I forgot an if (data == nullptr) teehee".

He, like the rest of us that don't work at Crowdstrike, has no idea what happened. I have seen computers do the weirdest gosh darn things. I know better than to assume anything at this point. I wouldn't even rule out weird stuff like the data getting corrupted between release qualification and release yet.

It turns out that C++, the language crowdstrike is using, likes to use address 0x0 as a special value to mean "there's nothing here", don't try to access it or you'll die.

This thread is full of these sorts of small technical inaccuracies and oversimplifications so I won't point out all of them, but nothing in the C++ standard requires null pointers to refer to memory address 0x0. Nor does it require that dereferencing a null pointer terminates the program.

Windows died not because C++ asked it nicely to, but because a driver tried to access an address which wasn't paged in.

Crowdstrike should have set up automated testing using address sanitizer and thread sanitizer that runs on every code update.

The funny thing about accessing into non-paged memory in kernel space:

  1. It will crash regardless of if it's running under Asan or not, sanitizers are literally irrelevant based on what we know so far
  2. The Asan version he linked to is for user-space. In the windows kernel you'd need KASAN instead.

(If this was a simple nullptr dereference on bad input data then perhaps a fuzzer would have helped. Fuzzers are great though I have no idea how hard they are to use with kernel drivers)

C++ is hard. Maybe they have a DEI engineer that did this

Dude would probably call me a "DEI hire"; but I bet I could beat him in a C++ deathmatch so neener neener.

[–] V0ldek@awful.systems 14 points 4 months ago (7 children)

Also, and this shouldn't be left unsaid, we're talking about the Windows kernel here. A place with C++ code so cursed it is legendarily unhealthy to work in, as the cosmic horrors contained within slowly eat away at your sanity and warp the perception of time and space. Seeing that code for a few hours is enough to make a grown man cry. Seeing that code for a few weeks is enough to make you never cry again, as the terrible truth worms its way into your mind.

"DEI hire", hah! The creature makes no distinction for race or gender as it fattens itself upon your failure! Even a glimpse at the edge of its abyss is enough to trigger a cycle of revelation - all modern software lies upon a rotting pile of ancient mistakes.

[–] fazalmajid@social.vivaldi.net 6 points 4 months ago (3 children)
[–] V0ldek@awful.systems 4 points 4 months ago (1 children)

Absolutely stellar writing, except for this one weird bit

Database people are systems people. Modern databases have their own memory management, thread scheduler, and a fucking compiler inside. A promising research direction is to just bundle the database with your own bloody kernel that you handwrote with a box of scraps to make the entire thing less cursed and not have to wrestle with Linux.

You know, just in case you were looking for people to include in your postapo gang, database experts will also murder whatever you want with bare hands.

[–] fazalmajid@social.vivaldi.net 2 points 4 months ago* (last edited 4 months ago) (1 children)

@V0ldek there's a difference between people who develop database engines, and people who use an existing database engine to write database applications in SQL or whatever.

It's just your comedic hyperbolic turns of phrase reminded me of Mickens'.

[–] V0ldek@awful.systems 2 points 4 months ago

If more than one system devs launch into a Lovecraftian stream of epithets about how incomprehensiblly horrific it is when you ask them about their work then there just may be some truth in it.

load more comments (1 replies)
load more comments (4 replies)
load more comments (24 replies)