Talk:2024 CrowdStrike incident

(Redirected from Talk:2024 CrowdStrike disruptions)
Latest comment: 19 minutes ago by AVNOJ1989 in topic Requested move 19 July 2024

What infobox should we use?

edit

I was thinking Template:Infobox bug, but I'm not sure what one would be the best. Lordseriouspig 07:50, 19 July 2024 (UTC)Reply

Template:Infobox event might be the most appropriate option, in the lack of any obvious alternative. The article at least right now is about the outages, not the specific bug (which is yet to be identified) that might be causing this. Gust Justice (talk) 08:16, 19 July 2024 (UTC)Reply
We could use event for the article <top> and then use infobox bug for the "technical details" section ZalnaRs (talk) 18:28, 19 July 2024 (UTC)Reply

Impact section already too unwieldy

edit

I know that it's very early days, but the Impact section is already getting out of hand. Is it too early to consider a spinoff? I'm not convinced that the readers are coming to this particular action for an exhaustive list of everyone impacted (a gargantuan list, evidently), and I think we should already start using the summary style, at least for the Impact section. Melmann 08:56, 19 July 2024 (UTC)Reply

Agree it is getting out of hand with just an inventory of geographic regions. It would seem to make more sense to go sector by sector, as an "IT outage" is more relevant to certain economnic/social impacts, rather than geographic regions. I'd favor of going with headings like "Transportation," "Banking and economics," "Broadcast and communications." Those three alone might account for 50-70% of all entries. - Fuzheado | Talk 09:09, 19 July 2024 (UTC)Reply
It should be done by sector instead of country. For example, a paragraph on aviation, one on banking, one on TV/media, etc. 2A00:23C8:308D:9E00:7588:FB7E:2907:414F (talk) 09:06, 19 July 2024 (UTC)Reply
Jinx. Great minds think alike. - Fuzheado | Talk 09:09, 19 July 2024 (UTC)Reply
Agreed. Should be split off by Sector Wolfstorm94 (talk) 09:39, 19 July 2024 (UTC)Reply
Good idea. This means we can summarise it all better. For example we can say how airlines were affected (and list major ones) which means we aren't duplicating content when listing every country. ―Panamitsu (talk) 10:07, 19 July 2024 (UTC)Reply
I've started with a new "Air transport" section and will be moving things there. - Fuzheado | Talk 10:47, 19 July 2024 (UTC)Reply
I will just add that I'm not sure sectors is necessarily cleaner, it is a bit more confusing to assess impact by country for example with some responses and impacts could being different. Now that some information has moved the impact on Germany or the USA is harder to understand than the yet to be touched Australia section to me.MyacEight (talk) 11:31, 19 July 2024 (UTC)Reply
Agreed, seems like a more logical way to split it in this context. Benpiano800 (talk) 13:58, 19 July 2024 (UTC)Reply
Just to provide a counterpoint: I came here specifically for a regional itemization of issues, so the current format was great for my needs. ―Rob Frawley 2nd (talk) 14:58, 19 July 2024 (UTC)Reply
To be honest, I preferred regional itemisation as well. I can understand both arguments. GhostOfNoMeme 15:46, 19 July 2024 (UTC)Reply
Fair enough. :-) ―Rob Frawley 2nd (talk) 16:52, 19 July 2024 (UTC)Reply
Crowdstrike has nearly 24,000 clients as per its last earnings report. That's customers, not devices. kencf0618 (talk) — Preceding unsigned comment added by Kencf0618 (talkcontribs) 09:58, 19 July 2024 (UTC)Reply
I am in the middle of implementing this sectioning. Are you sure it is an improvement?
If we don't trim stuff down, it will become a wall of text for each sector. 174.92.25.207 (talk) 15:43, 19 July 2024 (UTC)Reply
It would be a shame to have to trim significantly. Divided by sector, I feel that there isn't much room to comfortably go into sufficient detail. I would have kept the "Impact by country" with detailed descriptions, and reserved "Impact by sector" for something more akin to "Hospitals were affected in Australia, Brazil, Canada ..." and "Flights were delayed or cancelled in Australia, France, Germany ..." and so on. Maybe that would lead to a cumbersome article with an overwhelming amount of information and repetition, though...
Either way, there seems to be support for itemising by sector so I think it's worth sticking with it now. GhostOfNoMeme 15:54, 19 July 2024 (UTC)Reply
Neutral. Please do not delete information about the impact. Users will skim to the section that interests them. -- Dandv 22:04, 19 July 2024 (UTC)Reply

Response

edit

Should Response be listed by country? Currently only has Australian governmental response. TirFarThoinnExpora (talk) 09:26, 19 July 2024 (UTC)Reply

Either by country or by sector, I reckon, going by a previous conversation above. Procyon117 (talk) 09:54, 19 July 2024 (UTC)Reply
One initial appraisal is that the travel sector seems to be the hardest hit. https://techcrunch.com/2024/07/19/banks-airlines-brokerage-houses-report-widespread-outages-across-the-globe/ kencf0618 (talk) 10:37, 19 July 2024 (UTC)Reply
Um, I removed it in [1] without seeing this. Most other editors seemed to disregard the section distinction anyway. 174.92.25.207 (talk) 14:58, 19 July 2024 (UTC)Reply

Too, this is occurring by time zone. We'll need a sortable list... kencf0618 (talk) 10:00, 19 July 2024 (UTC)Reply

I'm not convinced it's very sensible to have this section. Every W10 corporate and public sector computer which received the CrowdStrike update will now be unbootable until the botched driver update is rolled back. IT departments are going to be very, very busy this weekend, and somebody at CrowdStrike will be looking for a new job. --Ef80 (talk) 10:10, 19 July 2024 (UTC)Reply
Agree - if it's typical "we're fixing it" type of responses, there's no need to include it. Only unusual or novel examples of responses would seem relevant to a special section. - Fuzheado | Talk 10:45, 19 July 2024 (UTC)Reply
I would advocate for public official responses, but maybe in one specific response section. Yes, an industry saying "we're working on it" isn't much of anything, but if a world leader or some major political figure starts talking shit about CrowdStrike, calls for better oversight, or erroneously jumps to blame foreign powers, it should get a mention. Schiffy (Speak to me|What I've done) 15:19, 19 July 2024 (UTC)Reply

Cyber

edit

Is any reliable source calling it a "cyber outage"? The only footnote using such a term is a CBC article which uses the term "IT outage" in the title. Nemo 10:15, 19 July 2024 (UTC)Reply

I know Reuters and DW are calling it a cyber outage. But with that being said quite a number of outlets are calling it an IT outage too. Is there any huge differences between these 2 terms? S5A-0043Talk 10:18, 19 July 2024 (UTC)Reply
The page was originally called "July 2024 global IT outages" but was moved without any explanation. ―Panamitsu (talk) 10:25, 19 July 2024 (UTC)Reply
The term "IT" in titles is not a great practice – it relies on jargon and as an acronym, it is too English-centric and does not lend itself to ready translation. Cyber or computer outage has its advantages. I do agree moves like these should be discussed. - Fuzheado | Talk 10:32, 19 July 2024 (UTC)Reply
I forgot to read the talk page before moving the page, but I would say that the current '2024 CrowdStrike incident' is a fine title. PhotographyEdits (talk) 11:13, 19 July 2024 (UTC)Reply
It's really bad form to unilaterally move the page without getting some form of consensus. Please don't do that. - Fuzheado | Talk 11:19, 19 July 2024 (UTC)Reply
AP is calling it a Global IT outage, but I think global cyber outage would be better. JoseMoranUrena (talk) 14:50, 19 July 2024 (UTC)Reply
"Cyber" is deprecated; "IT" is universally understood, and as such hardly jargon. kencf0618 (talk) 11:17, 20 July 2024 (UTC)Reply
I think you may overestimate how much the average reader would know what "IT" means when seen in isolation, especially since it is an English acronym which even further narrows its understandability. It would be useful to find out what other Wikipedia articles have the term "IT" in its title, as I cannot easily think of any. - Fuzheado | Talk 13:08, 20 July 2024 (UTC)Reply

Driver or Content Update?

edit

The president of Crowd Strike has just posted to Twitter/X that the issue was a faulty content update. Would this not be different to a driver update as written in the article? Should we change to content update? BeigeTeleprinter (talk) 10:48, 19 July 2024 (UTC)Reply

Are those two statements contradictory though? A driver is just a more specific description of the "content." - Fuzheado | Talk 10:51, 19 July 2024 (UTC)Reply
"Content" is just management PR bullshit. They rolled out a kernel driver update without testing it properly on W10. --Ef80 (talk) 11:15, 19 July 2024 (UTC)Reply
And none of the end users checked it before rolling it out either? 2A0A:EF40:10B2:D801:4960:9247:5147:8900 (talk) 11:23, 19 July 2024 (UTC)Reply
The updates install automatically without user intervention. Most Windows updates happen like that now, particularly in the corporate world. --Ef80 (talk) 12:38, 19 July 2024 (UTC)Reply
The files in question are not drivers. They are rather more configuration files that are loaded by the CrowdStrike sensor driver and controls it's behavior.
The format of those files is proprietary but it's easily possible to verify that they are not valid drivers. 2003:DE:9727:7A1E:E9AB:32B4:B808:A188 (talk) 11:39, 19 July 2024 (UTC)Reply
Per Ef80, I don't understand "content update". Perhaps "Configuration update"? 174.92.25.207 (talk) 13:44, 19 July 2024 (UTC)Reply
Primary sources (MS, CS) are calling it a "channel file" Does anyone know what a channel file is? — Preceding unsigned comment added by 1.159.91.86 (talk) 06:24, 20 July 2024 (UTC)Reply

Which Windows OS?

edit

The article doesn't specify which Windows versions. Are the versions 10 and 11? Unsure whether CrowdStrike still offers updates for its software on Windows 7. George Ho (talk) 12:11, 19 July 2024 (UTC)Reply

It appears to be W10 systems that are affected. Presumably CS developed the update on W11 and didn't test it on properly on W10. --Ef80 (talk) 12:46, 19 July 2024 (UTC)Reply
According to Cyber Security News it is at least Windows 10 and 11, although I don’t know where they have this information from. BeigeTeleprinter (talk) 12:47, 19 July 2024 (UTC)Reply
From Cyberstrikes own blog It is stated as being Windows 7.11 and above. I changed this already based on this source, but I'm not experienced here so please let me know if I've made a mistake.MeshBlair (talk) 06:06, 20 July 2024 (UTC)Reply
"Windows 7.11"? Is there such a thing? (Not to be confused with iCloud for Windows version 7.11, superseded by version 7.12 and later ver 14.1.) George Ho (talk) 17:58, 20 July 2024 (UTC)Reply
@MeshBlair, you're misunderstanding the source. When it says, "Customers running Falcon sensor for Windows version 7.11 and above [...] may be impacted," that version number is not referring to Windows, but to "Falcon sensor for Windows". That is, that 7.11 version number is referring to the Falcon sensor, not to Windows. —Lowellian (reply) 01:41, 21 July 2024 (UTC)Reply
Ah yes, you're definitely right now after a re-read. Sorry about that! MeshBlair (talk) 05:05, 22 July 2024 (UTC)Reply
On a personal note, in my workplace only the windows machines with a TPM were affected, the older windows machines without a TPM were unaffected. This has some interesting security risks for the future. 124.170.217.121 (talk) 14:00, 20 July 2024 (UTC)Reply

Lack of images

edit

This is a huge outage that affects a lot of places in the world but there is little to no images showcassing it ? i added one image of a self checkout being affected by the outage on wikimedia but on twitter i'm seeing a tonne of images of entire airport being shutdown its kind of bizare that none have made their way here no ? should i go to the airport to take more pictures ? Kou~ (talk) 13:29, 19 July 2024 (UTC)Reply

ive also seen images by social media users showing handwritten boarding passes, i think this could be a good addition to the above suggestion 197.240.106.98 (talk) 13:36, 19 July 2024 (UTC)Reply
@Koupip: You may have forgotten to save your "one image". In Special:Contributions/Koupip, you didn't edit the article. 174.92.25.207 (talk) 13:41, 19 July 2024 (UTC)Reply
i edited the french one not the english one as i try to not interfere too much with wikipedia since i suck at it as much as id like to help out lol, french wikipedia is kind of abandoned so i edit it on occassions. should i add the image to the english wiki page too ? the page seems really bloated and still under construction so i feel like it would caus more trouble then its worth no ? Kou~ (talk) 13:49, 19 July 2024 (UTC)Reply
Please just WP:BOLDly add the image to English Wikipedia. I think you adding the image is beautiful. Don't worry about causing trouble while the page just because the page is under construction, until you are reverted.
I doubt "french wikipedia ... so i edit it on occassions" after seeing fr:Spécial:Contributions/Koupip. There was a grammatical error (affecter) corrected later. 174.92.25.207 (talk) 14:29, 19 July 2024 (UTC)Reply
yeah i'm not too good with grammar which is why i don't edit wikipedia at all i just add pictures very rarely when it can help Kou~ (talk) 15:35, 19 July 2024 (UTC)Reply
Nvm, I will boldly add it instead. My edit got blocked by WP:EF 174.92.25.207 (talk) 14:50, 19 July 2024 (UTC)Reply
I've successfully asked someone on Xiaohongshu to give permission to upload an image of the crowd at an airport during the outage. They haven't put the permissions yet, so once they do it I'll upload the pic. S5A-0043Talk 13:45, 19 July 2024 (UTC)Reply

Windows activation servers down

edit

People from the massgrave project reported that activation was not possible from 0:44 to 0:53 (azure vms started to fail). possibly only US servers? ZalnaRs (talk) 13:57, 19 July 2024 (UTC)Reply

@ZalnaRs I believe this was part of a separate Azure outage before the crowdstrike incident. This is not relevant to this article. Aveaoz (talk) 09:32, 21 July 2024 (UTC)Reply

Consistency with Time Zones

edit

Most times in the article reference UTC, there is a single use of IST, and 2 rather unhelpful uses of "10:00" and "7:00 a.m".

Is there reason to warrant changing all times to UTC? TirFarThoinnExpora (talk) 14:03, 19 July 2024 (UTC)Reply

about the IST one, MOS:TIMEZONE allows it. Warm Regards, Miminity (talk) (contribs) 14:20, 19 July 2024 (UTC)Reply
Aha! Thank you! I'm a rather new editor, so thanks for the link. Kind regards, TirFarThoinnExpora (talk) 18:18, 19 July 2024 (UTC)Reply
I've taken a look at the sources for the uses of 10:00 and 7:00. They appear to be from sources within UTC+2 timezones, so I've added '(UTC+2)' to them. 🔥HOTm̵̟͆e̷̜̓s̵̼̊s̸̜̃🔥 (talkedits) 14:33, 19 July 2024 (UTC)Reply

Google Cloud and Azure detections

edit

Google Cloud and Azure started reporting bootlooping windows VMs. I think it should be included in the article.[1][2] ZalnaRs (talk) 14:03, 19 July 2024 (UTC)Reply

Both are now included. I note the Azure status page gets the date wrong; it says 04:09 UTC on the 18th, but it should say the 19th. GhostOfNoMeme 17:47, 19 July 2024 (UTC)Reply

References

DMY dates and American English?

edit

This combination seems inconsistent with MOS:TIES. Using MDY dates seems more appropriate. —⁠ ⁠BarrelProof (talk) 15:07, 19 July 2024 (UTC)Reply

It was originally written with tag {{Use New Zealand English}} and dmy dates [2]. We should not be defaulting to American English and date formats for a worldwide event. MOS:TIES does not demand use of American English, since it is a worldwide event, and the fact that it's a US company is trivial in comparison to the worldwide nature of the event. If anything, it should be switched back to New Zealand English (or similar Commonwealth English) as per MOS:RETAIN. Joseph2302 (talk) 15:16, 19 July 2024 (UTC)Reply
It currently says to use American English. It's about a faulty patch released by an American company for computers running an operating system from another American company. It was first observed in virtual computers running on a cloud computing system of an American company, and the source of the problem was identified about three hours later by another American company. —⁠ ⁠BarrelProof (talk) 15:22, 19 July 2024 (UTC)Reply
The impact is worldwide, but I don't believe it's fair to say the US connection is "trivial". CrowdStrike and Microsoft are American companies. GhostOfNoMeme 15:27, 19 July 2024 (UTC)Reply
And so is Google, which was who identified the source of the problem. —⁠ ⁠BarrelProof (talk) 15:36, 19 July 2024 (UTC)Reply
(edit conflict) It's about a worldwide outage that affected many companies and countries, not just the US. That's enough reason not to default to one countries' spellings/date formats, and apply MOS:RETAIN instead. Joseph2302 (talk) 15:28, 19 July 2024 (UTC)Reply
But if it's going to use DMY dates, it shouldn't be using American English. If it's going to use American English, it shouldn't be using DMY dates. The current combination doesn't make sense. —⁠ ⁠BarrelProof (talk) 15:32, 19 July 2024 (UTC)Reply
I would be happy with a switch to {{Use New Zealand English}} or {{Use British English}}, then, especially in light of the article's use of {{Use dmy dates}}. I have no strong opinion. But the current mismatch between dates and variety of English is worth addressing. GhostOfNoMeme 15:39, 19 July 2024 (UTC)Reply
It is a worldwide event, and the very first revision is clear in using {{Use New Zealand English}}. Per MOS:RETAIN, it should be used in this article. MOS:TIES does not apply since CrowdStrike is not the subject of the article, and the event itself is worldwide. You could just as easily say that MOS:TIES should be with Australia/New Zealand since the majority of early impact/reporting was in those timezones. Melmann 16:30, 19 July 2024 (UTC)Reply
The logic is that it happens worldwide, and especially in Australia/New Zealand. Why not use {{engvarb}} instead, and dmy dates. It should not use American English. ToadetteEdit! 16:39, 19 July 2024 (UTC)Reply
Not "especially" in NZ, AUS -- but due to timing of the update, NZ/AUS noticed it before USA. 1.159.91.86 (talk) 06:28, 20 July 2024 (UTC)Reply
I agree with BarrelProof that we should be using American English, given that the companies involved are all American and the impact seems to be spread pretty evenly worldwide. I don't see that it's especially bad in Australia/NZ, that impression may just be because of the time that it started (2PM AEST vs midnight EST) leading to it being noticed earlier there, or also customized search/news results based on user location. Kdroo (talk) 17:50, 19 July 2024 (UTC)Reply
At this stage (and considering MOS:RETAIN per the above) I think it's best left with New Zealand English (and dmy dates). GhostOfNoMeme 18:29, 19 July 2024 (UTC)Reply
There is insufficient justification for enforcing NZ English here. We have American companies on both counts - Microsoft as the main platform, and CrowdStrike as the one that caused the error. - Fuzheado | Talk 18:48, 19 July 2024 (UTC)Reply
MOS:RETAIN is settled policy and therefore plenty of justification. If you wish to argue for MOS:TIES then you need to build a broad consensus for the change. Melmann 08:31, 20 July 2024 (UTC)Reply
I have no opinion on which variety of English should be used, but as to your comment MOS:RETAIN is settled policy, the top of that page actually says that it's a guideline, not a policy. Thus, if there is consensus on this talk page to use American English here, I think MOS:RETAIN can be overridden in this specific case. – Epicgenius (talk) 18:08, 20 July 2024 (UTC)Reply
Strongly concur with User:Epicgenius. We're talking about an American company and the largest impacts of its error were felt by American companies, especially airports and airlines. MOS:TIES should control here. --Coolcaesar (talk) 19:29, 20 July 2024 (UTC)Reply
That's a very single-minded, America-centric view of the issue. If you want to see the article abandon one region, the move should be towards something standards based, not another region, regardless of economy size. BlakJakNZ (talk) 04:00, 21 July 2024 (UTC)Reply
Concur with retaining NZ English, or some form of worldwide English - this is a worldwide event, not specific to the US. pcuser42 (talk) 22:25, 20 July 2024 (UTC)Reply
NZ English is not worldwide English, is it? The most common and established English variants are American and British. Out of the two, American seems to make more sense due to reasons stated above Oneequalsequalsone (talk | contribs) 23:01, 21 July 2024 (UTC)Reply
Per other reasons stated above, effects of this incident were felt worldwide, not just in the US. I don't think the ties are strong enough to justify US English given the massive scale of what happened. pcuser42 (talk) 23:20, 21 July 2024 (UTC)Reply
I'm not necessarily saying this article should use it, but the closest thing to worldwide English is Oxford English, corresponding to {{Use Oxford spelling}}. It is used by the United Nations, the International Organization for Standardization, the WTO, NATO, the ICRC, and many other international organizations (see the Oxford English article for further detail). It is also very close to Canadian English. —⁠ ⁠BarrelProof (talk) 01:46, 22 July 2024 (UTC)Reply
For this particular article, there is a clear and close connection to the United States, and I think it would be best to use American spelling and MDY dates. (I didn't directly say that before, although my comments may have leaned in that direction.) CrowdStrike is a U.S. company that makes a product built to work in the context of an operating system made by another U.S. company. —⁠ ⁠BarrelProof (talk) 02:23, 22 July 2024 (UTC)Reply
MOS:RETAIN justifies keeping UK English over US English. There is no basis to go through changing s -> z, etc. However, I don’t think we should keep it as NZ English - that’s an odd, niche choice which leaves editors wondering if there are any peculiarities about that regional variant. There is no geographical or political nexus to NZ here. Local Variable (talk) 02:09, 22 July 2024 (UTC)Reply
MOS:RETAIN says to keep the variety of first significant contribution, in this case NZ English. No English variety is more justified than another, as there is no objectively correct way to write English. The only other valid argument for WP:ENGVAR change is MOS:TIES, but it does not apply since this was a worldwide event.
Also, American English is niche as well, only 17% of English speakers use it. Melmann 11:45, 22 July 2024 (UTC)Reply
Yeah, I don't necessarily agree with other editors that MOS:TIES applies here. Consider the WannaCry ransomware attack article: the attack used American NSA tools and targeted Microsoft Windows machines. Both the NSA and Microsoft are American, and yet the article uses British English and dmy dates (with the only talk page discussion explicitly invoking MOS:RETAIN). This event may have been caused by CrowdStrike, a US company, but the article is dedicated to the incident and outages that resulted; a truly global affair, just like the WannaCry attack. I don't think there are particularly "strong national ties", here, so MOS:RETAIN applies. GhostOfNoMeme 12:35, 22 July 2024 (UTC)Reply
Would you call the first contributions significant? Also, it results in confusion. I don’t consider RETAIN binds us to it. Unlike a change to US English, it doesn’t require overhauling the article. It is simply a recognition than NZ English is not appropriate. I think it’s also important to hear in mind why retain exists - it’s fundamentally to stop wars between contested variants where two might arguably apply, and disputes between US and UK English causing big edit wars. Neither applies here. Local Variable (talk) 12:36, 22 July 2024 (UTC)Reply
I'm open to using {{Engvarb}} instead of NZ English. pcuser42 (talk) 21:10, 22 July 2024 (UTC)Reply
The standard ISO 8601 for dates is YYYY-MM, YYYY-MM-DD or YYYYMMDD and should be used in all articles whose expected viewership is more than regional. — Preceding unsigned comment added by 2603:6000:aa00:151f::193b (talkcontribs) 19:55, 19 July 2024 (UTC)Reply
The Wikipedia guideline MOS:BADDATE does not consider that date format acceptable for Wikipedia. It says to use it "Only in limited situations where brevity is helpful". —⁠ ⁠BarrelProof (talk) 21:33, 19 July 2024 (UTC)Reply
Per WP:MOSTIES this article should be in American English: both Crowdstrike and Microsoft are U.S. companies and this event originated in the United States. TIES supersedes RETAIN when there are clear national-ties to a subject as there is when the two companies most involved are from one country, and the company which identified the cause is also from that country. Avgeekamfot (talk) 04:04, 22 July 2024 (UTC)Reply
I don’t agree with this application. It’s a worldwide incident. Local Variable (talk) 04:46, 22 July 2024 (UTC)Reply
That reasoning hasn't necessarily held in the past. The WannaCry ransomware attack involved two American entities, the NSA and Microsoft, and yet the article uses British English per MOS:RETAIN. Both were global incidents; the source of the incident being an American company doesn't make for a "strong national tie" in my opinion, otherwise we'd use British English for the BP oil spill. ;) GhostOfNoMeme 12:40, 22 July 2024 (UTC)Reply
Focus on the big picture. We're talking about an cybersecurity incident where the majority of the impact was sustained in the United States, in terms of the number of people affected and potential monetary damages incurred.
For three days, the Delta subreddit on the Reddit site has been full of horror stories from traumatized Delta passengers, crew and other personnel dealing with the airline's worst meltdown since 2017. YouTube has plenty of videos too. Thousands of people spent the weekend living rough in Hartsfield-Jackson because Metro Atlanta doesn't have enough hotel rooms for an emergency like this. Smaller numbers have been reported at other airports like Minneapolis and Salt Lake City. And the end of the mess is still nowhere in sight, with 500 more flights cancelled by Delta this morning. With about 5,000 flights cancelled by Delta to date, we're talking about several hundred thousand people who are now stuck waiting for days for seats on later flights, or having to spend several thousand dollars for last-minute tickets on other airlines or other modes of transport to salvage their travel plans. --Coolcaesar (talk) 15:17, 22 July 2024 (UTC)Reply

Title should be more specific

edit

There was a similar incident where crowdstrike pinned CPUs to 100% until devices were updated and restarted just 3 weeks ago at end of June, which was less impactful.

The title should probably be more specific with this in mind. "July 2024 CrowdStrike incident" perhaps? Or perhaps we can include a section to also mention this. Aveaoz (talk) 15:11, 19 July 2024 (UTC)Reply

I agree, we should make the title more specific.
I don't think it's appropriate to include a section on this article that mentions a separate (unrelated) incident. Jtbwikiman (talk) 15:26, 19 July 2024 (UTC)Reply
There is a contested request at Wikipedia:Requested moves/Technical requests by Luminism to move the article to July 2024 global IT outages. --Ahecht (TALK
PAGE
)
15:39, 19 July 2024 (UTC)Reply
But since that incident doesn't have an article or even a mention at CrowdStrike, that is no reason to change the article title. Gråbergs Gråa Sång (talk) 15:59, 19 July 2024 (UTC)Reply
Sounds to me like the June incident probably fails WP:N. Unlike today's incident. 🔥HOTm̵̟͆e̷̜̓s̵̼̊s̸̜̃🔥 (talkedits) 16:15, 19 July 2024 (UTC)Reply
The title needs to be more specific. Many sources say it is an outrage, while the title implies that it is an incident. Maybe start a requested move? ToadetteEdit! 16:42, 19 July 2024 (UTC)Reply
Or wait a few days. This article is like 10h old. Gråbergs Gråa Sång (talk) 16:50, 19 July 2024 (UTC)Reply
Agreed, "outrage" is rather tabloid in the circumstances. It's certainly a massive corporate screwup by CS though, and we'll have to see what's left of the company after the many, many lawsuits have beed settled. --Ef80 (talk) 17:06, 19 July 2024 (UTC)Reply
I believe Toadette means "outage", instead of "outrage". GhostOfNoMeme 17:29, 19 July 2024 (UTC)Reply
We could do a topbar. and say not to be confused with this ZalnaRs (talk) 18:50, 19 July 2024 (UTC)Reply
When we have a "not to be confused with", that usually refers to another WP-article. Gråbergs Gråa Sång (talk) 20:45, 19 July 2024 (UTC)Reply
Given the disparity between the notoriety of these two events, this feels unnecessary to me. It's like saying Barack Obama is not to be confused with my friend Barack, who works at McDonald's. Jtbwikiman (talk) 21:28, 19 July 2024 (UTC)Reply

Requested move 19 July 2024

edit

2024 CrowdStrike incident → ? – Two reasons: the first is that the lede of this article is straightforward; it instead say that there is an outrage, before saying how, where the title is derived from. Second, most reliable sources often refer this event as an outrage. The title should at least be moved to a title containing "outrage". ToadetteEdit! 16:54, 19 July 2024 (UTC)Reply

The word "outage" is redirecting to "downtime". The servers/computers are crashing and not working due to the drivers not working.
oppose: "CrowdStrike outage" is incorrect - CrowdStrike did not suffer an outage, their customers did. Alex Rosenberg (talk) 21:10, 21 July 2024 (UTC)Reply
But not everyone will read it like that, and it would certainly be misleading. Incident seems best in that regard. CycloneYoris talk! 09:55, 22 July 2024 (UTC)Reply
It could be, but I strongly feel that an unfamiliar reader would read it as "an outage at CrowdStrike". That would be the plain interpretation. Why introduce ambiguity when we have the opportunity to avoid it? GhostOfNoMeme 19:17, 22 July 2024 (UTC)Reply

Impact on the Government of the United States

edit

I'm a civilian employee of the US government and noticed that the impact on us has yet to be mentioned. I know my agency was hit due to the BSOD on my government-issued laptop referencing csagent.sys; OPM was presumably hit as well, the operating status hasn't been updated since yesterday morning.   –Skywatcher68 (talk) 17:30, 19 July 2024 (UTC)Reply

I started a section on this. Atubofsilverware (talk) 17:47, 19 July 2024 (UTC)Reply
I see a COI tag got added. Nonetheless, the effects on the US gov are important, so they should stay on the page. Atubofsilverware (talk) 17:53, 19 July 2024 (UTC)Reply
  Not done for now: it's not clear what changes you want to be made. Please mention the specific changes in a "change X to Y" format. Melmann 18:50, 19 July 2024 (UTC)Reply
It was done; see the bottom of the Social services section. It's a rough start but it's generally what they requested. Atubofsilverware (talk) 18:51, 19 July 2024 (UTC)Reply

Displaying text as images

edit

I'm concerned that the images of text such as KFC app notice and Vanden Borre website, except the BSOD screenshot itself, may not meet MOS:TEXTASIMAGES. At least for BSOD, it shows us what nearly every person affected saw, and BSODs themselves may have a sort of visceral impact that purely text could not, thus it, in my view, brings a value beyond just the textual content of the image. The other two, however, could be transcribed into one of the divbox templates if the text itself is seen to be of value, so at least the accessibility concerns raised by MOS:TEXTASIMAGES are resolved. Melmann 19:02, 19 July 2024 (UTC)Reply

English Grammar

edit

Can we follow American English by saying "July 19, 2024" instead of "19 July 2024"? Please. 2601:40A:8400:1820:41C7:7591:2AE9:2851 (talk) 19:24, 19 July 2024 (UTC)Reply

See the above discussion. GhostOfNoMeme 19:28, 19 July 2024 (UTC)Reply

Withdrawal of race car?

edit

In the Response section, how is the withdrawal of a car from a race part of a response to the company's faulty software update? The cited source does not explain this. —Finell 19:45, 19 July 2024 (UTC)Reply

The driver, Sponsor was Crowdstrike and their CEO.
the car was withdrew in the aftermath of the outage. AidenT06 (talk) 20:24, 19 July 2024 (UTC)Reply

Is the Southwest Airlines, bit necessary?

edit

Firstly, Is it needed? Do we need to list the companies that weren't effected? Also the article linked is very speculatory. "Some are attributing that to Windows 3.1. Major portions of Southwest’s systems are reportedly built on Windows 95 and Windows 3.1" AidenT06 (talk) 21:42, 19 July 2024 (UTC)Reply

@AidenT06 Doesn't add to anything of value to the article, agreed. PipitSweet16 (talk) 22:01, 19 July 2024 (UTC)Reply
Windows 3.1 is thirty years old. This is nonsense. 24.40.254.80 (talk) 22:17, 19 July 2024 (UTC)Reply
That's certainly a weirdly specific (and perhaps embarrassing) reason for not being a CrowdStrike customer. 3df (talk) 22:17, 19 July 2024 (UTC)Reply
@AidenT06 I also agree. While humorous, the Digital Trends article links to another article written by a Forbes.com contributor, which is generally unreliable. The Forbes article itself then links to The Dallas Morning News which quotes someone saying Southwest's systems look like they were designed on Windows 95, without really confirming anything. Limmidy (talk) 22:35, 19 July 2024 (UTC)Reply

The fact remains that Southwest and FedEx remained operational, and for the same reason. kencf0618 (talk) 22:29, 19 July 2024 (UTC)Reply

But it’s not relevant. I could list thousands of companies that had no issues AidenT06 (talk) 22:43, 19 July 2024 (UTC)Reply
List thousands of global airlines.kencf0618 (talk) 11:07, 20 July 2024 (UTC)Reply

Only one expert?

edit

Doesn't it seem a bit reactionary putting the opinion of a single expert (Troy Hunt) about the magnitude of the outage in the beginning of the article? Besides, I think he should at least be named to keep it less vague on who this expert is. Iofr (talk) 00:16, 20 July 2024 (UTC)Reply

They'll be more. Global in impact? Sure. As such, comparable to what? The end of the article basically says that it's the Y2K that happened. Nice bookends. kencf0618 (talk) 11:14, 20 July 2024 (UTC)Reply
The section needs to be expanded with the commentary published by reliable sources. I've added a section notice to this effect. Melmann 12:11, 20 July 2024 (UTC)Reply

Calling a finite and countable number of clients "innumerable"

edit

made me stop reading this entry right after the first sentence. Unscientific, hyperbolic, and unfactual. 50.46.244.66 (talk) 02:27, 20 July 2024 (UTC)Reply

One of the definitions of "innumerable" is "too many to be counted". You're just arguing over semantics here. 0xC0000005 (talk) 02:49, 20 July 2024 (UTC)Reply
Entry: the sky is red
I: that's factually incorrect
You: it is factually incorrect but you're arguing over semantics
lol 50.46.244.66 (talk) 05:04, 20 July 2024 (UTC)Reply
"Innumerable" in English means more than whatever narrow definition you're giving it. It fits. GhostOfNoMeme 03:34, 20 July 2024 (UTC)Reply
Hyperbolic??? Perhaps, a bit; but it's hard to count while the full extent is currently unknown. "Innumerable" in the vernacular sense does not mean "uncountable" in the mathematical sense. DWIII (talk) 04:54, 20 July 2024 (UTC)Reply
That's a real problem. Wikipedia articles should generally avoid hyperbolic language. I see this as a definition of innumerable: "too many to be counted (often used hyperbolically)". You admit the usage in the article doesn't follow the mathematical sense, so it is hyperbolic and that's unnecessary and just bad. The idea that the crashes can't be counted is also stupid. CrowdStrike knows exactly how many computers received the bad update. Not all of them crashed, but this is a strict upper bound. Using "innumerable" in an encyclopedia article when there is a known upper bound and reasonable estimates on the lower side is simply a very poor choice. 165.189.255.50 (talk) 05:03, 20 July 2024 (UTC)Reply
"A large number of", perhaps? It seems very difficult to quantify right now. GhostOfNoMeme 06:15, 20 July 2024 (UTC)Reply
We now have the opposite problem – "caused a large number of" understates the impact. Trying better middle path wording: "caused widespread problems as computers and virtual machines running Microsoft Windows crashed and were unable to properly restart." - Fuzheado | Talk 12:24, 20 July 2024 (UTC)Reply
That's good, I like that. Hopefully we get hard statistics (e.g. "$x devices impacted") in reliable sources, at some stage. I've searched but, unsurprisingly, I see nothing yet beyond guesstimation. GhostOfNoMeme 13:18, 20 July 2024 (UTC)Reply
Numbers are starting to come through now - approx. 8.5 million devices [3] pcuser42 (talk) 22:22, 20 July 2024 (UTC)Reply
They were innumerable because they hadn't been counted. It took a while to estimate... kencf0618 (talk) 21:09, 21 July 2024 (UTC)Reply
Innumerable means cannot be counted not too lazy to be arsed.
BTW, the $ damage was already being estimated while we discuss whether the number of clients impacted can be determined. 50.46.244.66 (talk) 03:28, 22 July 2024 (UTC)Reply
You might want to check your definitions. https://en.wiktionary.org/wiki/innumerable - "Of a very high number; extremely numerous" pcuser42 (talk) 03:56, 22 July 2024 (UTC)Reply
edit

Do we really need to wikilink "computer", "cybersecurity", "software", "crash", etc. in the lead? I really don't think so. We should be able to have an opening sentence or two without linking every other word. GhostOfNoMeme 03:50, 20 July 2024 (UTC)Reply

Looking much better. GhostOfNoMeme 13:46, 20 July 2024 (UTC)Reply

screencaps of various TV channels that went down?

edit

Perhaps there should be screenshots of the notices broadcast when a number of TV networks went down -- 65.92.247.96 (talk) 06:00, 20 July 2024 (UTC)Reply

@65.92.247.96 I think they are copyrighted in a way we can't use it ZalnaRs (talk) 09:00, 20 July 2024 (UTC)Reply
I had considered this early on, e.g. Sky News or CBBC in the UK, but as ZalnaRs mentioned I was unsure of the copyright implications. GhostOfNoMeme 13:51, 20 July 2024 (UTC)Reply
WP:TOO should be able to cover some of them. A simple message would not be covered under copyright. And if they are all above the threshold, then WP:NFCC should allow use of one of them under a WP:FUR, as a representative of all of them, if none of them fall below WP:TOO. -- 65.92.247.96 (talk) 04:20, 21 July 2024 (UTC)Reply
@65.92.247.96: Nope, these are covered by TOO because they are based in the UK (where the TOO is extremely low compared in the US, see COM:TOO UK and Typographical copyright). I'll leave the determination if there are fair-use rationale to more experienced people, but I also think that it will not pass the treshold either. 2001:4453:59F:A200:F961:EA9:D4F3:54A7 (talk) 08:11, 21 July 2024 (UTC)Reply

Why <code> is used for a file name and a directory

edit

Help:Wikitext says "Small chunks of source code within a line of normal text. Code is displayed in a monospace font." However are a file name and a directory small chunks of source code?

"deleting any .sys file beginning with C-00000291- in the %windir%\System32\drivers\CrowdStrike\ directory." is wierd.

"deleting any .sys file beginning with C-00000291- in the %windir%\System32\drivers\CrowdStrike\ directory."

or

"deleting any ".sys" file beginning with "C-00000291-" in the "%windir%\System32\drivers\CrowdStrike\" directory." is better.

―― Phoenix7777 (talk) 11:08, 20 July 2024 (UTC)Reply

Endorse using monospaced font – it's useful to see filenames and commands from that Microsoft DOS context distinct from the Wikipedia article prose. It's a standard practice in technical documentation and writing to do this in service to the reader. - Fuzheado | Talk 12:07, 20 July 2024 (UTC)Reply
Exactly what Fuzheado said. This is not a standard prose, rather a computing related technical terminology. It is required to distinguish it from normal prose. — DaxServer (t·m·e·c) 12:12, 20 July 2024 (UTC)Reply
I would leave it in monospace. This is how I would write docs for work, too. They aren't quite source code, true, but I think it suits the article well and benefits the reader to clearly distinguish these parts in a technical context. GhostOfNoMeme 13:50, 20 July 2024 (UTC)Reply

Why take down paragraph on Amazon's issues?

edit

@Valereee:, why did you delete the paragraph on the disruptions that were suffered by Amazon? The contents were clearly referenced including quotes and were from a published source i.e. CNBC, the American business news channel. You didn't even put a reason, just a straight delete. Microsoft-CrowdStrike issue causes ‘largest IT outage in history’

On WP:Blogs it says: "Some newspapers host interactive columns that they call blogs, and these may be acceptable as sources so long as the writers are professionals and the blog is subject to the newspaper's full editorial control" and following on "Note that otherwise reliable news sources--for example, the website of a major news organization--that happens to publish in a "blog" style format for some or all of its content may be considered to be equally reliable as if it were published in a more "traditional" 20th-century format of a classic news story."

The deleted paragraph was taken from a CNBC blog, but the subject seems to justify its inclusion. Richard Nowell (talk) 11:24, 20 July 2024 (UTC)Reply

Looks like that was an edit conflict. Valereee (talk) 12:17, 20 July 2024 (UTC)Reply
I think I've added it back, please check my work! Valereee (talk) 12:20, 20 July 2024 (UTC)Reply
Looks good, thankyou for your help with this matter. Richard Nowell (talk) 20:25, 20 July 2024 (UTC)Reply

Dulles Airport Photo

edit

The photo taken of the BSOD in Dulles Airport appears to be edited. It does not display the entire message. In addition, the message encroaches on the physical border of the display in the lower-right edge. Obviously edited photos like these affect the reputation of Wikipedia and its legitimacy as a source. 2601:703:4180:22C0:A935:B53F:B5E9:215B (talk) 15:30, 20 July 2024 (UTC)Reply

No one has edited the picture, it’s a resolution mismatch between the computer and the monitor, along with a borderless display and JPEG image compression artifacting. Celjski Grad (talk) 16:53, 20 July 2024 (UTC)Reply

Draft:Impact of the 2024 CrowdStrike incident

edit

An editor has created a draft about the impact. Thoughts? Curb Safe Charmer (talk) 17:47, 20 July 2024 (UTC)Reply

As it exists now, it is an improper wholesale copy/paste of the "Impact" section of this article and could be considered a copyright violation. - Fuzheado | Talk 17:54, 20 July 2024 (UTC)Reply
From how unwieldy the section has become, I think moving it to a separate article and shortening this section with more concise information would be would be better. 187.0.175.230 (talk) 23:23, 20 July 2024 (UTC)Reply
It really isn't that long compared to other articles of this type. - Fuzheado | Talk 07:18, 22 July 2024 (UTC)Reply

Silly question, but why wasn't a WP:SPLIT proposal made? Limmidy (talk) 23:50, 20 July 2024 (UTC)Reply

I also shared that concern here: Draft talk:Impact of the 2024 CrowdStrike incident. - Fuzheado | Talk 06:29, 21 July 2024 (UTC)Reply
FYI, SafariScribe moved it from draft to main space, and I have reverted it, moving it back to draft over concerns about improper WP:SPLIT and copyright. - Fuzheado | Talk 14:09, 21 July 2024 (UTC)Reply

Non-correlatable information from NoypiGeeks

edit

I've been trying to find another source that would confirm that "telecommunications, radio and TV broadcasts were affected in the Philippines" and "Supermarkets in the Philippines were affected due to crashed POS systems." as asserted in the NoypiGeeks citation (https://www.noypigeeks.com/computers/windows-outage-affecting-workers-industries/) but the other sources only stated disruptions in some government agencies, local airlines and banking services, but none in relating to telecommunications nor broadcasting. - 2001:4453:59F:A200:DD0D:5C5D:B60F:C71 (talk) 18:16, 20 July 2024 (UTC)Reply

It has been confirmed that telecommunications are not affected in the Philippines, so I have deleted the statement about telecommunications. AnimMouse (talk) 12:12, 22 July 2024 (UTC)Reply

Remedy - no mention of Bitlocker as a complicating factor

edit

Under Remedy, the basic solution is mentioned. The difficulty of performing the remedial actions is mentioned. However, a significant complication in the process is the reality that a large proportion of the affected machines are corporate machines that utilise Bitlocker, and there are additional complicating steps that this incurs. There have been reports that people have not been able to obtain their Bitlocker keys because of the systems storing them being compromised. I know of an affected individual following the instructions from an IT dept as to now to obtain the Bitlocker key for the affected machine discovering that the system was not able to report a Bitlocker key for the machine. It seems to me that the Remedy section should probably at least mention the possibility/probability of the additional work involved when Bitlocker was used, and the additional impacts experienced by IT ops as a result.

MS instructions including Bitlocker path: https://support.microsoft.com/en-us/topic/kb5042421-crowdstrike-issue-impacting-windows-endpoints-causing-an-0x50-or-0x7e-error-message-on-a-blue-screen-b1c700e0-7317-4e95-aeee-5d67dd35b92f

Crowdstrike document on attempting a fix without Bitlocker keys: https://www.crowdstrike.com/wp-content/uploads/2024/07/Bitlocker-recovery-without-recovery-keys.pdf Fivey (talk) 01:20, 21 July 2024 (UTC)Reply

edit

the citation for elon musk removing crowdstrike requires paying or signing up for an account. is this allowed? 81.100.136.25 (talk) 07:55, 21 July 2024 (UTC)Reply

@81.100.136.25 Yes, see WP:PAYWALL. I marked that source as needing subscription just now also. Aveaoz (talk) 09:23, 21 July 2024 (UTC)Reply
yes but it’s not a hard to access source, just linking the tweet would be better? 81.100.136.25 (talk) 12:42, 21 July 2024 (UTC)Reply

Draft:Patch management

edit

Given the topical updates on the cause of the incident, note there is currently a draft awaiting review for Patch management. Tule-hog (talk) 09:47, 21 July 2024 (UTC)Reply

Publish and be damned! It looks well referenced and written... Copy the contents of the draft onto a new page template... 92.8.77.232 (talk) 20:59, 21 July 2024 (UTC)Reply
🫡 Tule-hog (talk) 21:12, 21 July 2024 (UTC)Reply

XKCD

edit

Randall is being nicely topical — see XKCD 2961 published on Friday. Is it too soon for an "In popular culture" section? — GhostInTheMachine talk to me 11:29, 21 July 2024 (UTC)Reply

The way I see it, citing a third party work can only be justified if WP:RS commentary uses it as a point of reference. Us just choosing to feature a single webcomic over any other (I'm sure many hundreds were made on the topic) seems arbitrary. Melmann 11:49, 22 July 2024 (UTC)Reply

Name change to 2024 global outage?

edit

In my reasoning, I believe that since most people will recognise this as a significant outage with large damages and huge consequences, and it is likely to be historic with not many knowing the backstory, it would make sense to change the name to “2024 Global Outage.” JulesTheKilla (talk) 14:00, 21 July 2024 (UTC)Reply

Rather than starting a new thread, please see the existing discussion above in #Requested move 19 July 2024. - Fuzheado | Talk 14:11, 21 July 2024 (UTC)Reply

Frownie face

edit
 
QR-code BSoD

We have File:CrowdStrike blue screen of death.png (QR-code BSoD), but another common BSoD shown on the news was the unhappy-face emoticon version. That should be made available either in a gallery here, or on COMMONS, if someone has it to upload -- 65.92.247.96 (talk) 22:36, 21 July 2024 (UTC)Reply