Mastodon - 2024-08-07T15:38:31Z

Mastodon

"The new IPC Template Type defined 21 input parameter fields, but the integration code that invoked the Content Interpreter with Channel File 291’s Template Instances supplied only 20 input values to match against...In part, this was due to the use of wildcard matching criteria for the 21st input during testing”

crowdstrike.com/wp-content/upl

Mastodon Source 🐘

"We have completed fuzz testing of the Channel 291 Template Type and are expanding it to additional Rapid Response Content handlers in the sensor.”

Mastodon Source 🐘

I'm guessing there will be a lot of unhelpful “Why didn't they already do phased rollouts to minimize blast radius and confirm safe to continue signals? Everybody knows that!" comments.

Counterpoint: there's a known vulnerability and you're responsible for “minimizing time to zero affected surface area”. How would you argue for intentionally delaying that closure, especially when the phased rollout "has never failed” so there's no counterfactual data?

Mastodon Source 🐘

Also, from personal experience those "safe to proceed signals" aren't as accurate or precise as imagined.

Heterogeneity of environments, user workloads, timezones, regions, scale, latent dynamic conditions (implicit assumptions that are often lumped into "infrastructure") make those signals informative, but not definitive.

Mastodon Source 🐘