Hmmm…
Crowdstrike is a permanent performance issue in my experience. I wish our organisation would drop them.
Some IT administrators suffered a moment of deja vu on Thursday morning as CrowdStrike blamed a cloud service issue for performance problems and lagging boot times affecting some of European customers. "CrowdStrike hits again," noted one admin on Reddit, along with: "At least it's not on a Friday." While it likely needs no …
If I remember my past experiences, one of the performance issue with Outlook was at a time (around Y2K) it insisted to inspect ALL messages sent on Windows systems, even if it was not the intended recipient.
One of the reasons you still see the recommendation to close all programs before performing a software installation...
Some of our developers have been benchmarking things like builds with and without Crowdstrike. The overhead is indeed pretty bad.
That said, in my formative professional-developer years I was frequently using machines and working on projects that could take an hour or more to build, so I can't say I personally feel terribly inconvenienced by EDR performance costs. On the rare occasions where I have to wait a few minutes for a build or other automated process, there is plenty of other work I can be doing. (Even for complete interruptions, like the always-tiresome Windows update process, I have journal articles to read and whatnot.)
> Why would Crowdstrike be using 'cloud services' on a customer's machines?
It's cheaper than maintaining their own hardware. Besides, isn't it possible for the innovators to design an OS that's runs from read-only media. With the apps run on a virtual machine. That disappears into the æther on reboot.
I think the most important question is why does that piece of garbage has to phone home beyond asking for a fresh file at boot and once in a while during a day.
Apparently that thing ( and that's also my experience when I was in an org with that piece of bloatware ) phones home all the time.
The only good thing I saw about it was that when there's no network connection, it sulks in it's corner and doesn't whine constantly that it can't call mommy over the net. ( but still slows up the system by rying to find a working network connection.
The article does rather make it sound as though CS Falcon is signature-matching files against white/blacklists in the cloud, meaning that slow cloud performance slows down local performance.
I'm sure - or at least, before July's outage exposed their incompetence, I would have been sure - there's some caching of those lists in play though.