crowdstrike

Immune Dysfunction

by

(This column is posted at www.StevenSavage.com and Steve’s Tumblr.  Find out more at my newsletter, and all my social media at my linktr.ee)

OK back at it after a long amount of not blogging. And let’s talk about the panic over AI and internet security and what gets missed.

Writing this in October of 2026, I’m hearing about all sorts of stories of AI breaching security. Oh and AI made and/or uploaded code that is vulnerable but is downloaded due to complicated dependencies. And the usual stuff about AI and security and it killing us all.

I’m kind of used to it by now. Also not exactly impressed. Congrats, your code told me someone hasn’t updated dependency libraries in three years, thanks AI. I liked you better when you were called Machine Learning and we’re less hyped. Yes, I know the internet is filled with stupid vulnerabilities, I got to see them grow up. I was there at the start.

Here’s the thing when I look at all the internet crises and security vulnerabilities and failures. I recall when the Internet was about failover. It was designed to work around failures and outages and stay connected. But boy we were into that connectivity a lot more.

So everything was about connectivity. More connectivity. Delivering more. Companies jumped onto the internet and looked at all sorts of ways to do more, deliver more – and of course take control of it. Even non-profits or “sort of benevolent non-profit” were all about getting you that information and code as fast as possible forget the rest.

We used to have a lot of computer security because so much was not connected, and there was plenty of human intervention and human paranoia about all this new stuff. We had security by aggressive and unintentional obscurity, plus Ray, the sysadmin, who kept bugging us.

In a way we kind of sort of had an IMMUNE SYSTEM in the old internet and computer age. We just didn’t notice it. We forgot about Ray when he retired.

Then we connected it all together and wondered why things kept going wrong. I think one of the great summaries for me is the Crowdstrike outage. The service and software to protect interconnected computers all over failed and took down chunks of the internet. We were all connected, had all these defenses up, and were so dependent on ONE SERVICE that it created a failure. Think that over for awhile – we defended our connections with another dependency that blew the hell up.

Right now the issues of AI and about every damn other problem of technology is a mix of Late Stage Capitalism and not having an immune system in our technology. We jack everything together to sell Bluetooth Aquariums, then watch it all fall apart because it’s all connected with no defenses (or if there are the defenses go down as one company does 90% of it).

Complain about AI and everything else. What we have though is a lack of a technology immune system in the world. Actually the more annoying parts of AI and the internet in general exist due to this lack of the immune system.

Maybe it’s time we look back a few decades and ask how things ran, why, and what we missed because it was just there.

Steven Savage

It’s Not The Next Outage

by

(This column is posted at www.StevenSavage.com, Steve’s Tumblr, and Pillowfort.  Find out more at my newsletter, and all my social media at my linktr.ee)

So the CrowdStrike Outage of 2024 happened. Actually, let me clarify, the CloudStrike Outage of July 2024. I might as well be clear because that was a doozy and it showed some wide-raging system instabilities. Also considering it was such a disaster maybe there’s another.

If you don’t know what I’m talking about, an update to some security software bricked a lot of windows machines in a disaster that shouldn’t have happened. If “scrutiny software shut down systems” sound bad, yes it was!

If “security disaster happened” AND you work in IT, AND your friends are nerds and/or work in IT, you know MY experience. I spent most of that Friday quietly losing my mind.

Of course there’s questions of “how do we avoid the next outage” which is sort of sad, because you’d kind of like there not to be one, or one as widespread. But I don’t think that’s quite the issue, preparing for the next Giant Ooposie misses two things.

First, this exposed just how vulnerable systems are, and I’m worried about intentional attacks. We saw in real time how a software update could destroy systems. We saw how people did – or didn’t recover. We saw where vulnerabilities might be. We wondered what would have happened had this been during another crises – hurricane, terrorist attack, etc.

CrowdStrike was a mix of blueprint, roadmap, and test run for how to screw up IT systems worldwide. This is what you get by accident, meaning intentional attacks are now much easier to pull off effectively. We need to worry about intention.

Imagine a CrowdStrike-like outage but with more destructive not just an issue that an in theory be fixed by booting 15 times. Something designed to not be recoverable, an IT WMD.


Secondly, we’ve just seen that many major systems are just plain vulnerable period. Everyone is on Windows, a lot of people use CrowdStrike, and recovery plans were individual. Though I was impressed with the global recovery, if you’re an IT pro or hang out with them (I do both) you know this was not easy.

Recovering from a one-shot, caught, error is one thing. But it’s a reminder that we are very vulnerable and might want to be questioning about how a lot of infrastructure is set up. How many smaller-scale disasters do we not see because it wasn’t big news? My general take is systems need to be easier to recover, more diverse, and honestly more walled off.

Also we need to stop depending on heroism in IT security. It should be incredibly boring.

The next CrowdStrike type error should not happen. But right now my concern is what happens intentionally, what may happen on a smaller scale at first, and that we’re probably not ready for either.

CrowdStrike was a wake-up call to so many things wrong in modern infrastructure, so many things that could go wrong. As much as the company screwed up massively there’s far more to worry about.

Steven Savage