Speaker 1: A media Hello one, Welcome to a very special emergency
Speaker 1: episode of Better Offline. I'm at Zeitron, I'm your host,
Speaker 1: and I'm recording this from inside a closet in a
Speaker 1: hotel in San Francisco. You're very important to me. On
Speaker 1: Friday afternoon, I sat at my desk and just started
Speaker 1: writing about any clear aim or objective other than a
Speaker 1: desire to wrap my head around probably the most cataclystic
Speaker 1: technological meltdown that I've seen in my career, And of
Speaker 1: course I'm referring to the CrowdStrike situation. How was it
Speaker 1: the piece of software, one that few people understood, made
Speaker 1: by a company that people really didn't know was able
Speaker 1: to shut down our banking system, mayor travel, TV logistics chains,
Speaker 1: those weird screens that you see around and of course hospitals.
Speaker 1: And as I wrote this script, I found myself returning
Speaker 1: to some of the themes that I wrote about in
Speaker 1: The Rock Economy, in the Shareholder Supremacy, and many other
Speaker 1: pieces that speak to a larger problem in the tech industry,
Speaker 1: a complete misalignment in the incentives of most major tech companies,
Speaker 1: which has become less about building new technologies and maintaining
Speaker 1: them and then selling them to people who would then
Speaker 1: use them over time, and more about capturing monopolies and
Speaker 1: gearing organizations to extract value from the things around them.
Speaker 1: Every problem you see is a result of the tech industry,
Speaker 1: from the people funding the earliest startups to the trillion
Speaker 1: dollar juggernauts that dominate our lives, and the fact that
Speaker 1: it's no longer focused on the creation of technology with
Speaker 1: a purpose and organizations driven towards said purpose. Everything's about
Speaker 1: expressing growth and about showing how you will dominate an
Speaker 1: industry rather than serve it, and providing metrics that speak
Speaker 1: to the paradoxical notion that you'll grow forever without any
Speaker 1: consideration of how you'll actually live that long. Legacies are
Speaker 1: now subordinate to monopolies, current customers are subordinate to new customers,
Speaker 1: and products well, they're considered the means to introduce a
Speaker 1: customer to a form of parasite designed to punish the
Speaker 1: user for even thinking about moving to a competitor. The
Speaker 1: key difference between what happened on Friday with CrowdStrike and
Speaker 1: by the way, it's still being fixed, and as I'll
Speaker 1: explain later, will really take some time to be fully resolved,
Speaker 1: and my criticisms of other companies like Facebook and Google
Speaker 1: is the sheer violent nature of this failure, the decline
Speaker 1: of search and social tools we use in it is
Speaker 1: kind of a gradual, incremental kind of rot. CrowdStrike, meanwhile,
Speaker 1: was a demonstration of what happens when the rod fully
Speaker 1: consumes the timber holding up the building. What's happened with
Speaker 1: CrowdStrike is completely unprecedented. I'll get to why shortly, and
Speaker 1: on the scale of the much feared why to Q
Speaker 1: bug that threatened to ground the entirety of the world's
Speaker 1: computer based infrastructure once the year two thousand began. You'll
Speaker 1: note that I'm not saying that White was over hyapt
Speaker 1: or dismissing the scale, because ydo K was a huge
Speaker 1: society threatening calamity waiting to happen, and said calamity was
Speaker 1: averted not through any kind of magical thinking, but through
Speaker 1: a remarkable half trillion dollar industrial effort that took a
Speaker 1: decade to manifest. Because the seriousness of such a significant
Speaker 1: single point of failure would have likely crippled governments, banks,
Speaker 1: and airlines, people laughed when nothing happened on January first,
Speaker 1: two thousand, Assuming that all that money and time had
Speaker 1: been wasted. All of the media was just being hysterical
Speaker 1: rather than being grateful that an infrastructural weakness was identified
Speaker 1: taken seriously, and that a single point of failure was
Speaker 1: dealt with, and that the crisis was averted by investing
Speaker 1: in stopping bad staff happening before it does. Crazy goddamn idea. Huh.
Speaker 1: But as we speak, millions or even hundreds of millions
Speaker 1: of different Windows based computers are now stuck in a
Speaker 1: doom loop, repeatedly showing us as the fame blue screen
Speaker 1: of death, thanks to a single point of failure in
Speaker 1: a company called CrowdStrike, the developed of a globally adopted
Speaker 1: cybersecurity product designed ironically to prevent the kinds of disruption
Speaker 1: that we witnessed on Friday end. We're still witnessing today,
Speaker 1: and for reasons we'll get into shortly, this nightmare is
Speaker 1: going to drag on for several days, if not weeks
Speaker 1: to come. The product called CrowdStrike Falcon Sensor is an
Speaker 1: EDR system which stands for endpoint Detection and Response. If
Speaker 1: you aren't a security professional and your eyes are glazing over,
Speaker 1: I'll keep it brief an EDR system is designed to
Speaker 1: identify hacking attempts, to remediate them prevent them. They're big,
Speaker 1: sophisticated and complicated products, and they do a lot of
Speaker 1: things that's quite hard to build with the standard tools
Speaker 1: available to Windows developers. But as I'll get to later,
Speaker 1: not Microsoft, and so to make Falcon sensor work, CrowdStrike
Speaker 1: had to build its own internal kernel driver. Now, kernel
Speaker 1: drivers operate at the lowest level in the computer. They
Speaker 1: have the highest possible permissions, but they operate with the
Speaker 1: fewest amount of guardrails because massive control and they're very
Speaker 1: important to the system. Very technical people can to hear
Speaker 1: that and be like, that's not the right way to
Speaker 1: put it. Get out not your podcast. But if you've
Speaker 1: ever built your own computer, or you remember what computers
Speaker 1: were like in the dark days of Windows ninety eight,
Speaker 1: you know that a single faulty kernel driver can wreak
Speaker 1: havoc on the stability of your system. The problem here
Speaker 1: is that CrowdStrike pushed out an evidently broken kernel driver
Speaker 1: that locked whatever system that installed it in a permanent bootloop,
Speaker 1: meaning that you just started Blue Screen of Death, restarted
Speaker 1: kept doing him, the system would start loading Windows Encounter
Speaker 1: a fatal error and reboot, and then reboot, and then
Speaker 1: reboot again and again and again, in essence rendering the
Speaker 1: machine useless. It's convenient to blame CrowdStrike here, and perhaps
Speaker 1: that's fair, and I intend to do so several times.
Speaker 1: This should not have happened on a basic level. Whenever
Speaker 1: you write or update a kernel driver, you need to
Speaker 1: know it's actually robust and won't shit the bed immediately. Regrettably,
Speaker 1: CrowdStrike seemed to borrow Boeing's approach to quality control, except
Speaker 1: instead of building plane where the doors fly off and
Speaker 1: Boeing is the noise it makes when they fly off
Speaker 1: at the most inopportune times, it released a piece of
Speaker 1: software that blew up the transportation and banking sectors. The
Speaker 1: name just a few. It created a global IT outage
Speaker 1: that as grounded flights and broken banking services. It took
Speaker 1: down the BBC's flagship TV channel for kids, infuriating parents
Speaker 1: across the British isles, as well as Sky News, which,
Speaker 1: when it was able to resume life broadcasts, was forced
Speaker 1: to do so without graphics. In essence, it was forced
Speaker 1: back to the nineteen fifties, giving an esthetic that matches
Speaker 1: the politics of its founder and former owner, Rupert Murdoch.
Speaker 1: By no means is this exhaustive list of those affected. Either.
Speaker 1: The scale and disruption caused by this incident is unlike
Speaker 1: anything we've ever seen before. Previous instances like this, particularly
Speaker 1: rival ransomware outbreaks like Wanna Craze, simply can't compare, especially
Speaker 1: when we're looking at the disruption at the sheer scale
Speaker 1: of this problem. Still, if your day has been ruined
Speaker 1: by this outage, at least spare a thought for those
Speaker 1: will have to actually fix it, because those machines affected
Speaker 1: are now locked in this boot loop. It's not like
Speaker 1: CrowdStrike and just release a new software patch and call
Speaker 1: it a day on Doing this update requires some users
Speaker 1: to have to individually go to each computer, loading up
Speaker 1: safe mode or limited version of Windows with most non
Speaker 1: essential software and drivers disabled, and manually remove the faulty code.
Speaker 1: And if you have encrypted your computer, that process gets
Speaker 1: a lot harder. Servers running on cloud services like Amazon
Speaker 1: Web Services and Microsoft Azure, you know, the way that
Speaker 1: most of the Internet's infrastructure works, requires an entirely different
Speaker 1: and much more annoying, separate series of actions. If you're
Speaker 1: on a small item team, and you're supporting hundreds of
Speaker 1: workstations across several far flung locations, which really isn't unusual
Speaker 1: these days, especially in sectors like retail and social care.
Speaker 1: You're especially fucked. Say goodbye to your weekend, your evenings,
Speaker 1: Say goodbye to your spouse, your kids. You won't be
Speaker 1: seeing them for a while, and I'm really sorry. I'll
Speaker 1: buy you a drink some time. Your life will be
Speaker 1: driving from site to site, applying the figs and moving on.
Speaker 1: Forget about sleeping in your own bed or eating a
Speaker 1: meal that wasn't brought to you by door dash, Good luck, godspeed,
Speaker 1: God bless. I do not envy you. I so gratefully
Speaker 1: have a fake job. You know what do envy? I
Speaker 1: was buying the products that follow this utterly seamless ad break,
Speaker 1: which will likely echo my exact sentiments on literally every
Speaker 1: issue ever. And we're back. The significance of this failure,
Speaker 1: which isn't a breach, by the way, and in many respects,
Speaker 1: is far worse, at least with destruction it courst is
Speaker 1: not its damage to individual users, but to the amount
Speaker 1: of technical infrastructure that runs on Windows, and that so
Speaker 1: much of our global infrastructure relies on automated enterprise software
Speaker 1: that when it goes wrong, breaks everything. It isn't about
Speaker 1: the number of computers, but the amount of them that
Speaker 1: underpin things like security checkpoints or systems that run airlines
Speaker 1: or banks or hospitals, all running as much automated software
Speaker 1: as possible so that the costs can be kept down.
Speaker 1: Hey remember the raw economy. Jesus fucking The problem here
Speaker 1: is systemic that there's a company that the majority of
Speaker 1: people affected by the outage had no idea existed until
Speaker 1: well a day or two ago, that Microsoft trusted to
Speaker 1: the extent that they were able to push an update
Speaker 1: that broke the back of a chunk of the world's
Speaker 1: digital infrastructure. Microsoft a company, instead of building the kind
Speaker 1: of rigorous security protocols that would say, I don't know,
Speaker 1: rigorously tests something that connects to what seems to be
Speaker 1: a huge portion of Windows computers, Well, they just chose
Speaker 1: to do something else. They've just screwed the fuck up.
Speaker 1: As pointed out by Whir, the company vets and cryptographically
Speaker 1: signs all kernel drivers, which is sensible and good because
Speaker 1: kernel drivers have an incredible amount of access and thus
Speaker 1: can inflict serious harm. With this testing process, usually taking
Speaker 1: several weeks. What happened Microsoft? How did this slip through
Speaker 1: Microsoft's fingers? Well, for this to have happened, two companies
Speaker 1: needed to screw up epically in boy, fucking howardy did they?
Speaker 1: What we're seeing isn't just one major fuck up, but
Speaker 1: the first of what will be many systemic failures, some small,
Speaker 1: some potentially larger, that are the natural byproduct of the
Speaker 1: growth of all costs ecosystem, where any attempt to save
Speaker 1: money by outsourcing major systems is one that must simply
Speaker 1: be taken to please the beautiful, sexy shareholder that they
Speaker 1: all love so much. And this is a problem with
Speaker 1: the digitization of society, or more specifically, the automation of
Speaker 1: once manual tasks. It introduces a single point of failure,
Speaker 1: or rather several of them, or clustered together like a
Speaker 1: rat king or a Katamari. Our world, our lifestyle, and
Speaker 1: our economy is dependent on automation and computerization, with these
Speaker 1: systems in turn dependent on other systems to work, and
Speaker 1: if one of those systems breaks, the effects rick shay
Speaker 1: outwards like ripples mean you cast a rock in a
Speaker 1: lake or throw a body in. For some listeners, Freddy's
Speaker 1: CrowdStrike cockup is just the latest example of this, but
Speaker 1: it isn't the only one. Some of you might remember
Speaker 1: the Solar Winds hacked back in twenty twenty, where Russian
Speaker 1: state link hackers gained access to an estimate eighteen thousand
Speaker 1: companies in public sector organizations including NATO, the European Parliament,
Speaker 1: the US Treasury Department, and the UK's National Health Service
Speaker 1: by compromising just one service, Solar wins Oryan Remember when
Speaker 1: Octa some of you might know Octa is a company
Speaker 1: that makes software that handles authentication for a bunch of websites,
Speaker 1: governments and businesses. Well, when they got hacked in twenty
Speaker 1: twenty three, they then lied about the scale of the breach. Hey,
Speaker 1: do you remember when those hackers leap frogged from Octa
Speaker 1: to a bunch of other companies like cloud Flare. Yeah,
Speaker 1: they provide the content delivery services and the services that
Speaker 1: protect websites from being well brought down by a bunch
Speaker 1: of bots. From much the entire Internet, everything feels like
Speaker 1: it's being held up by like twigs and chewing gum.
Speaker 1: You probably know the quote no man is an island,
Speaker 1: and it's especially true when we're talking about tech, because
Speaker 1: when you scratch beneath the surface, every system that looks
Speaker 1: like it's independent is actually heavily, heavily dependent on services
Speaker 1: and software provided by a very small number of companies,
Speaker 1: many of whom are not particularly good. And this is
Speaker 1: as much a cultural failing as it is a technological one,
Speaker 1: the result of a management culture geared towards value extraction,
Speaker 1: building systems that build monopolies by attaching themselves to other monopolies.
Speaker 1: CrowdStrike went public in twenty nineteen and immediately popped on
Speaker 1: its first day of trading thanks to wall streets appreciation
Speaker 1: of them moving away from a focused approach to serving
Speaker 1: large enterprise clients, building products now for small and medium
Speaker 1: sized businesses by selling through channel partners, in effect outsourcing
Speaker 1: both product sales and the relationship with the client that
Speaker 1: would tailor a business a solution to said client. Especially
Speaker 1: when something is so serious like this, I want you
Speaker 1: to really think about this and think about this problem,
Speaker 1: because the problem isn't so much selling to small businesses
Speaker 1: or media businesses. It's the fact that CrowdStrike made its
Speaker 1: money selling to the enterprise and specializing in that, and
Speaker 1: that's the thing. When you broaden out, when you must
Speaker 1: grow in all directions, at all times, in all ways
Speaker 1: to please the horny beasts of Wall Street, you lose
Speaker 1: your focus. But that isn't the only problem, because Crowdstrike's
Speaker 1: culture appears to also fucking suck. A recent Glassloor entry
Speaker 1: referred to CrowdStrike as great tech with terrible culture with
Speaker 1: no work life balance, with leadership that does not care
Speaker 1: about employee well being. Another from June twenty twenty four
Speaker 1: claim that CrowdStrike was changing its culture for the street
Speaker 1: with KPIs as in metrics related to your success at
Speaker 1: the company, driving behavior more than building relationships, with a
Speaker 1: serious lack of experience in the public sector in senior management.
Speaker 1: So glad that this company is selling intellect government anyway.
Speaker 1: Moving on, others complained of micromanagement, with one claiming that
Speaker 1: management is the biggest issue, with managers asking way too
Speaker 1: much of you and it doesn't matter if you do
Speaker 1: what they ask since they're not even around to check
Speaker 1: on you, and another saying that management is arrogant and
Speaker 1: needed to stop lying to the market on product capability.
Speaker 1: That's what I love to see, we all love to
Speaker 1: see that. I'm very happy to read that, And while
Speaker 1: I can't say for sure, I'd imagine an organization with
Speaker 1: such powerful signs of growth at all costs thinking a
Speaker 1: place where you and I quote have to get used
Speaker 1: to the pressure, that's a clique that you're not in.
Speaker 1: Likely isn't giving its quality assurance teams the time and
Speaker 1: the space to make sure that there aren't any Kaiju
Speaker 1: level security threats baked into an update. And that assumes
Speaker 1: it actually has a significant QA team in house and
Speaker 1: hasn't just this with many companies outsourced the work to
Speaker 1: a body shop like Wypro or Emphasis or Tartar Consultancy.
Speaker 1: But for a moment, I'm going to change gears a
Speaker 1: little to try and explain what actually happened and why.
Speaker 1: It suggests that the issue is likely the product of
Speaker 1: cost cutting and institutional failure within CrowdStrike. In the aftermath
Speaker 1: of Friday's incident, we've seen some analyses about what actually
Speaker 1: went down with them first some throat clearing. I haven't
Speaker 1: verified this stuff independently. From what I've read, though, and
Speaker 1: from speaking to developers, this all seems relatively plausible, but
Speaker 1: maybe worth googling this a little yourself. But I'm going
Speaker 1: to give it a go. So the kernel driver at
Speaker 1: fort was written with a programming language called C plus plus.
Speaker 1: This language was developed in the nineteen eighties and it's
Speaker 1: very good for writing high performance applications, anything where you're
Speaker 1: concerned about speed, like the Interenno's operating system or a
Speaker 1: video game. It's pretty popular for that, and it's so
Speaker 1: pretty dangerous too, so dangerous in fact, that it's often
Speaker 1: referred to as an unsafe language. Without getting two into
Speaker 1: the weeds. C plus plus makes it incredibly easy to
Speaker 1: shoot yourself and the foot, the ars, and the dick.
Speaker 1: At the same time, it's big, complex and has few
Speaker 1: safeguards while providing many opportunities for developers to screw up
Speaker 1: very badly. Like the languages derived from C, it forces
Speaker 1: developers to deal with a lot of low level stuff
Speaker 1: like handling memory allocation that you don't really have to
Speaker 1: deal with in many popular languages like Python, Java, Russ,
Speaker 1: Swift or Sea sharp. And this matters because if you
Speaker 1: screw this up, your code will break, or I don't know,
Speaker 1: it might introduce some kind of potentially disastrous security vulnerability.
Speaker 1: In twenty nineteen, Microsoft researchers said that seventy percent of
Speaker 1: all security vulnerabilities were the result of memory management issues,
Speaker 1: and I doubt that figure has changed much since then.
Speaker 1: And earlier this year, the White House Office of the
Speaker 1: National Cyber Director urged developers to stop using unsafe languages
Speaker 1: like C and C plus plus and start using modern
Speaker 1: and safer alternatives like Rust. With me so far, ah, So,
Speaker 1: from what I've read, the CrowdStrike Falcon sensor kernel driver
Speaker 1: crash because it had something called a null pointer error. Essentially,
Speaker 1: the developer wrote some code that told the program to
Speaker 1: look for a memory location that didn't exist, and didn't
Speaker 1: write any safeguards to protect against them. When this happened,
Speaker 1: the driver and so the operating system crashed. This is
Speaker 1: a rookie mistake, and I've talked to multiple developers that
Speaker 1: have backed this up. If you take an introductory C
Speaker 1: plus plus programming class at university, they'll cover this in
Speaker 1: the first year. Kind of boggles the mind how trivial
Speaker 1: a mistake this is, and how it made it into
Speaker 1: production code, which is the code that goes out into
Speaker 1: the real world, and how it wasn't caught either by
Speaker 1: CrowdStrike or by Microsoft, who are supposedly obligated to vet
Speaker 1: this driver, and if the reports are true, someone really
Speaker 1: really really screwed up, really badly. But if you don't
Speaker 1: want to screw up, if you want to really do
Speaker 1: well in life, I advise you to buy one of
Speaker 1: the following products or services, which I of course fully understand,
Speaker 1: know all about and won't be embarrassed by.
Speaker 2: And we're back.
Speaker 1: And to be clear, I don't want you to think
Speaker 1: that I'm letting Microsoft off the hook either, assuming the
Speaker 1: kernel driver testing roles are still being done in house.
Speaker 1: Do you think that these testers who have likely seen
Speaker 1: their friends laid off at a time when Microsoft was
Speaker 1: highly profitable and denied raises, when their welfared CEO probably
Speaker 1: took home over one hundred million dollars in salary for
Speaker 1: a job he's eminently bad at. Do you think these
Speaker 1: people doing their best work? Do you think they go
Speaker 1: into a jazz full of piss and vinegar ready to
Speaker 1: save the world, or do you think they hate their
Speaker 1: job and they're being forced to do too much and
Speaker 1: they're miserable, And the people that knew what the fuck
Speaker 1: was going on haven't been fired, and the people who
Speaker 1: managed those people and the people that wrote the code
Speaker 1: that they're edited. Do you think anyone knows what the
Speaker 1: hell is going on? No, they don't, And this is
Speaker 1: the culture that's poisoned almost the entirety of Silicon Valley.
Speaker 1: What we're seeing now is the societal cost of moving
Speaker 1: fast and breaking things of people like Mark Andresen considering
Speaker 1: risk management the enemy of hiring and firing things. Thousands
Speaker 1: of people, tens of thousands in some case, to please
Speaker 1: Wall Street, are seeking as many new possible ways to
Speaker 1: make as much money as possible, to show shareholders that
Speaker 1: you'll grow, even if doing so means growing at a
Speaker 1: pace that makes it impossible to sustain organizational and cultural stability.
Speaker 1: When you aren't intentional on the people you hire and retain,
Speaker 1: the people you fire, the things that you build, the
Speaker 1: way that they are deployed, maintaining your systems, understanding how
Speaker 1: and why things were written, the decisions that were made five, ten,
Speaker 1: and fifteen years ago, you're going to lose the people
Speaker 1: to understand the problems they're solving, and thus lack the
Speaker 1: organizational ability to understand the ways the problems might be
Speaker 1: solved in the future, or disasters might be averted. This
Speaker 1: is dangerous, and it's also a dark warning for the future.
Speaker 1: Do you think the Facebook or Microsoft or Google, all
Speaker 1: of whom have laid off over ten thousand people in
Speaker 1: the last year, have done so in a conscientious way,
Speaker 1: in a knowledgeable way, a people focused a way, in organized,
Speaker 1: zationally rigorous way that means that the people are left
Speaker 1: who understand how their systems run and the inherent issues
Speaker 1: built into them. Do you think the management types obsessed
Speaker 1: with unsustainable AI bullshit are investing heavily in making sure
Speaker 1: that their organizations are rigorously protected against, say, one bad
Speaker 1: line of code or one dipshit error. Did they even
Speaker 1: know who wrote the code of their current systems? Is
Speaker 1: that person still there? Do they have their email and
Speaker 1: their phone number? Is that person at least contracted to
Speaker 1: make sure that something nuanced about the system in question
Speaker 1: isn't mistakenly removed or changed or quote fixed. No, now
Speaker 1: they're not, They're gone. They're not there anymore. Only a
Speaker 1: few months ago, Google laid off two hundred employees in
Speaker 1: the core of its organization, outsourcing their roles to Mexico
Speaker 1: and India in a cost cutting measure. The quarter after
Speaker 1: the company made twenty three billion dollars in profit I'm
Speaker 1: jumping to Google because they're just probably next in one
Speaker 1: of these horrible breaches or sorry, not breaches. Silicon Valley
Speaker 1: in big tech writ large is not built to protect
Speaker 1: against situations like the one we saw on Friday and
Speaker 1: the damage we're going to get from CrowdStrike because the
Speaker 1: culture's cancer. He values growth or costs with no respect
Speaker 1: for the human capital that empowers organizations or the value
Speaker 1: of building rigorous, quality focused products that are maintained over time.
Speaker 1: You know me, I'm a nasty little bitch. What are
Speaker 1: more on the nose? Example, George Kurtz, the CEO and
Speaker 1: co founder of CrowdStrike, said in twenty twenty that not
Speaker 1: one time has he regretted firing someone too fast, in
Speaker 1: a conversation where he argued that tech executives were becoming
Speaker 1: too obsessed with culture, and in a stunning act of foreshadowing,
Speaker 1: when he was the chief technology officer at McAfee, best
Speaker 1: known as the company that makes antivirus software that they
Speaker 1: sell to your granddad and that they ship with computers
Speaker 1: and you immediately uninstalled, while he oversaw an update that
Speaker 1: treated in the central part of Windows XP as a
Speaker 1: virus quarantining it and sending the computer into a boot loop.
Speaker 1: It's almost a little too on the nose. They're calling
Speaker 1: him the prabagar Ragavan of security. It's a very bad deal.
Speaker 1: But dear listener, this is just the beginning. Big Tech is,
Speaker 1: to quote trivium, in the throes of perdition, teetering over
Speaker 1: the edge of the abyss, finally paying the harsh cost
Speaker 1: of building systems as fast as possible. But let's be honest,
Speaker 1: they're not paying the cost we are. This isn't simply
Speaker 1: moving faster, breaking things, but doing so without any regard
Speaker 1: for the speed at which you're doing so, and firing
Speaker 1: the people that could fix them more might have broke them,
Speaker 1: the people that know what's broken, possibly the people who
Speaker 1: might have an idea to stop this happening in the future.
Speaker 1: And it's not just tech Boeing, a company I've already
Speaker 1: shat on plenty and one ll likely return to in
Speaker 1: the future, largely because it exemplifies the short sightednus of
Speaker 1: managerial fuckery, has over the past twenty years or so,
Speaker 1: span off huge parts of the company. Parts of that
Speaker 1: at one point we're vitally important probably still are into
Speaker 1: multiple other separate companies laid off thousands of employees at
Speaker 1: a time and outsource software development too nine dollars an hour.
Speaker 1: Body shop engineers fucking how hollowed itself out until there
Speaker 1: was nothing left and then the planes started breaking. And
Speaker 1: tell me, knowing what you know about Boeing today, would
Speaker 1: you rather get on the seven three seven max on
Speaker 1: Airbus A three twenty neo. I guess it depends how
Speaker 1: much of a Buddy Holly fan you are. Anyway, As
Speaker 1: these organizations push their engineers harder and harder and have
Speaker 1: less of them because they've been laying them off, said
Speaker 1: engineers will need to find a way to write code quickly,
Speaker 1: and perhaps they'll turn to AI generated code, which poisons
Speaker 1: code bases with insecure and buggy writing. As companies shed
Speaker 1: staff to keep up with wall streets demands in ways
Speaker 1: that I'm not really sure people are capable of understanding yet,
Speaker 1: when you have less engineers and bigger time constraints, and
Speaker 1: by the way, Prabagar Ragavan at Google specifically told people
Speaker 1: they'd be doing things faster with less people. It's so cool.
Speaker 1: I love tech. When you have less people, more time constraints,
Speaker 1: they're going to turn to whatever little tricks they can
Speaker 1: and wouldn't you in that situation too, You have to
Speaker 1: ship faster than this possible. Of course you're going to
Speaker 1: do that. But the companies that run the critical parts
Speaker 1: of our digital lives do not invest in maintenance, or
Speaker 1: cultural unity or any kind of rigorous infrastructure. If I'm honest,
Speaker 1: you need intentionality as well when building these things. You
Speaker 1: need it. It's required to prevent the kinds of things
Speaker 1: that happened on Friday with CrowdStrike, and the kind of
Speaker 1: systemic failures that you're going to see in the future.
Speaker 1: And they need you to be ready for this to
Speaker 1: happen again. And all of this is the horrifying cost
Speaker 1: of the rot economy. Systems used by billions of people,
Speaker 1: held up by flimsy cultures and brittle infrastructure, maintain with
Speaker 1: the diligence of an absentee parent. This is the cost
Speaker 1: of arrogance, of rewarding managerial malpractice, of promoting speed over
Speaker 1: safety and profit over people. Every single major organization should
Speaker 1: see crowdstrike's failure as a wake up call, a time
Speaker 1: to reevaluate the fundamental infrastructure behind every single tech stack.
Speaker 1: What I fear is they won't that they'll see it
Speaker 1: as someone else's problem, just like Microsoft did. And that's
Speaker 1: exactly how we got there in the first place. And
Speaker 1: this is going to keep happening. I'm going to make
Speaker 1: a daring suggestion at the end of this one, based
Speaker 1: on guest of the show they're on, Assamerglu, I believe
Speaker 1: it's time to start bringing in criminal prosecution to executives.
Speaker 1: If you, as the executive, are pushing the kind of
Speaker 1: cultures where basic security practices are failing, where managers do
Speaker 1: not exist, where checks and balances don't exist, you should
Speaker 1: be held responsible. And I don't mean a fine, by
Speaker 1: the way, A fine for a multi trillion dollar even
Speaker 1: multi billion dollar company is just a fee with a
Speaker 1: different hat on. No, I believe there should actually be
Speaker 1: a criminal inquiry in to CrowdStrike, in to Microsoft, and
Speaker 1: the people responsible are not necessarily the workers. No, the
Speaker 1: people responsible are people like satch In the Della, the
Speaker 1: CEO of Microsoft, and George Kurtz, the CEO of CrowdStrike,
Speaker 1: both of whom should face criminal investigations. We do not
Speaker 1: know at this time the significance of this event, but
Speaker 1: we know it's more significant than almost any computer infrastructure
Speaker 1: or failure in history and in affected hospitals. Do you
Speaker 1: think people didn't die? Do you think that something didn't break?
Speaker 1: Do you think that there's not a corpse on satch
Speaker 1: in Adela and George Kurtz's goddamn hands. Yes, it would
Speaker 1: be blood, but still we keep going. These people are
Speaker 1: responsible and they're not afraid, and they should be. There
Speaker 1: must be consequences for this level of fuck up. Microsoft
Speaker 1: made over ten billion dollars of profit in the last quarter.
Speaker 1: By the way, the market cab of CrowdStrike before this happens,
Speaker 1: around eighty nine billion dollars. Microsoft could probably in a
Speaker 1: space of years profits buy them in cash or build
Speaker 1: their own goddamn system. But they chose not to save money,
Speaker 1: and CrowdStrike in turn found other ways to save money,
Speaker 1: and saving money will likely have ended lives and ruined them.
Speaker 1: This is why I'm so pissed off everyone, This is
Speaker 1: why I'm so frustrated. This is what I've been talking
Speaker 1: about from the goddamn beginning of this goddamn show. This
Speaker 1: is the consequence. This is what will happen, and will
Speaker 1: happen again and again and again. This is the first
Speaker 1: of many calamities that will happen as a direct result
Speaker 1: of companies run by people that don't give a shit,
Speaker 1: of a Silicon Valley culture built on exploitation and value extraction,
Speaker 1: and of a business cartel run by people all agreeing
Speaker 1: to do the same level of shitty job, of holding
Speaker 1: no one accountable, of not calling out they're peers for
Speaker 1: running shitty companies because everyone's in on the scam. And
Speaker 1: it's a culture that is failing society, and the culture
Speaker 1: that I will continue to eviscerate every goddamn week until
Speaker 1: they well kick me out of this closet I'm in
Speaker 1: reading to you. It's such a pleasure reading this stuff,
Speaker 1: and I hope I've given you more clarity. If you
Speaker 1: have any questions, you'll hear my email address after this.
Speaker 1: But it's E. That's the letter Easy, the letter Z
Speaker 1: at better offline dot com and a's EAZ at better
Speaker 1: offline dot com for my wonderful British listeners. Thank you
Speaker 1: for listening, and if this affected you, I'm so sorry,
Speaker 1: and it likely did. Normal people, people in hospitals, banks, airports,
Speaker 1: people traveling got their lives fucked up by this, and
Speaker 1: I'm one hundred percent sure people have died. It's time
Speaker 1: for criminal inquiries, and it's time for criminal prosecution. It's
Speaker 1: time for real consequences for executives who don't give a shit.
Speaker 1: You heard it here first, well, and I guess they're
Speaker 1: on set it first. Be safe out there. Thank you
Speaker 1: for listening to Better Offline.
Speaker 3: The editor and composer of the Better Offline theme song
Speaker 3: is Matasowski. You can check out more of his music
Speaker 3: and audio projects at Matasowski dot com, M A T
Speaker 3: T O S O W s ki dot com. You
Speaker 3: can email me at easy at Better Offline dot com
Speaker 3: or visit Better Offline dot com to find more podcast
Speaker 3: links and of course, my newsletter. I also really recommend
Speaker 3: you go to chat dot Where's youreed dot at to
Speaker 3: visit the discord, and go to our slash.
Speaker 1: Better Offline to check out our reddit. Thank you so
Speaker 1: much for listening.
Speaker 2: Better Offline is a production of cool Zone Media. For
Speaker 2: more from cool Zone Media, visit our website cool Zonemedia
Speaker 2: dot com, or check us out on the iHeartRadio app,
Speaker 2: Apple Podcasts, or wherever you get your podcasts.