[Info-vax] A meditation on the Antithesis of the VMS Ethos

[Arne Vajhøj]

On 7/22/2024 8:34 AM, Simon Clubley wrote:
> On 2024-07-21, Craig A. Berry <craigberry at nospam.mac.com> wrote:
>> On 7/21/24 4:41 AM, Subcommandante XDelta wrote:
>>> The problem here is that Crowdstrike pushed out an evidently broken
>>> kernel driver that locked whatever system that installed it in a
>>> permanent boot loop. The system would start loading Windows, encounter
>>> a fatal error, and reboot. And reboot. Again and again. It, in
>>> essence, rendered those machines useless.
>>
>> It was not a kernel driver.  It was a bad configuration file that
>> normally gets updated several times a day:
>>
>> https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/
> 
> If it's something that can stop the system from booting, then it _should_
> be treated as if it _was_ a kernel driver.

It was config for and impacting behavior of kernel code.

So yes.

> IOW, what on earth happened to the concept of a Last Known Good boot to
> automatically recover from such screwups ? Windows 2000, over 2 decades
> ago, had an early version of the LKG boot concept for goodness sake.
> 
> What _should_ have happened, and what should have been built into Windows
> years ago as part of the standard procedures for updating system components,
> is that the original version of files that were used during the last good
> boot were preserved in a backup until the next successful boot.
> 
> After that, the preserved files would be overwritten with the updated
> versions. OTOH, if the next boot fails, the last known good configuration
> is restored and another reboot done, but exactly _once_ only. (If the LKG
> boot fails, then it's probably some hardware failure or other external
> factor).

Definitely a good concept.

Note though that it would require a smart definition of good boot.

The problem happened rather late and Windows may very well have
considered the startup successfully completed.

Arne