Re: A meditation on the Antithesis of the VMS Ethos

On 7/22/2024 8:34 AM, Simon Clubley wrote:

On 2024-07-21, Craig A. Berry <craigberry@nospam.mac.com> wrote:

On 7/21/24 4:41 AM, Subcommandante XDelta wrote:

The problem here is that Crowdstrike pushed out an evidently broken
kernel driver that locked whatever system that installed it in a
permanent boot loop. The system would start loading Windows, encounter
a fatal error, and reboot. And reboot. Again and again. It, in
essence, rendered those machines useless.

>
It was not a kernel driver.  It was a bad configuration file that
normally gets updated several times a day:
>
https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/

 If it's something that can stop the system from booting, then it _should_
be treated as if it _was_ a kernel driver.

It was config for and impacting behavior of kernel code.
So yes.

IOW, what on earth happened to the concept of a Last Known Good boot to
automatically recover from such screwups ? Windows 2000, over 2 decades
ago, had an early version of the LKG boot concept for goodness sake.
 What _should_ have happened, and what should have been built into Windows
years ago as part of the standard procedures for updating system components,
is that the original version of files that were used during the last good
boot were preserved in a backup until the next successful boot.
 After that, the preserved files would be overwritten with the updated
versions. OTOH, if the next boot fails, the last known good configuration
is restored and another reboot done, but exactly _once_ only. (If the LKG
boot fails, then it's probably some hardware failure or other external
factor).

Definitely a good concept.
Note though that it would require a smart definition of good boot.
The problem happened rather late and Windows may very well have
considered the startup successfully completed.
Arne