Siblings miss crucial life-extending treatment because of CrowdStrike

> Neither the software or any other Crowdstrike offerings are for use in the operation or aircraft navigation, nuclear facilities, communication systems, weapons systems, DIRECT OR INDIRECT LIFE-SUPPORT SYSTEMS, air traffic control, or any application OR INSTALLATION WHERE FAILURE COULD RESULT IN DEATH, SEVERE PHYSICAL INJURY, or property damage. SOFTWARE USER agrees that it is SOFTWARE USER’S RESPONSIBILITY TO ENSURE SAFE USE OF SOFTWARE AND ANY OTHER CROWDSTRIKE OFFERING IN SUCH APPLICATIONS AND INSTALLATIONS.

We don't really think long and hard enough about isolation of systems, and what levels of access they actually need to be able to do their tasks. It's entirely practical to build completely isolated networks. US Government (and most major governments) operate classified networks with air gaps, network diodes and the like. We don't have to make everything actually internet accessible, while still retaining the ability to get data in to such isolated networks.

Looks like Crowdstrike outsources their SDET/QA while keeping most software engineers stateside.

I generally don't have an issue with outsourcing, but it's obvious they're trying to save money on QA here. A few 200k SDETs could of probably caught this.

I see this at tons of companies, they see QA as less important...

I wonder how many people didn't get so lucky?

    Error 451
    It appears you are attempting to access this website from a country outside of the
    United States, therefore access cannot be granted at this time.

https://web.archive.org/web/20240720155219/https://www.kiro7...

My general practitioner once treated me during a power outage, all I had to do was come back and have my insurance scanned later.

Siblings miss crucial life-extending treatment at Seattle Children’s because of CrowdStrike outage

They were one link in what appears to be a pretty fragile dependency graph.

For example, wouldn't it possibly make sense to also blame:

* Regulators / insurers / etc. who require passing the audits that mandate using services like this.

* System designers who failed to implement disaster recovery plans for this scenario.

* Auditors who failed to highlight this risk.

* Device vendors who made medical equipment susceptible to this kind of DoS.

* U.S. FDA / DEA who allowed and/or mandated systems with this kind of vulnerability.

* Voters (in democracies) who ultimately bear responsibility for their government's actions/inactions.

Etc.?

Presumably it was planned in advance, so the patients know the time of their appointment and the doctor knows what was planned, and everything necessary to physically perform the treatment is already prepared at the hospital. What's stopping them from doing it without filling it into a digital system? Why is it impossible to make a paper record and fill it into the computer system later?

If somebody was literally dying, would they stand around the computer like confused characters in a The Sims game who can't find the door, instead of saving the life? And if not, why is this less urgent case different?

Hopefully folks learn from this.