Some notes: - seems CS can't update through middleboxes. This is an unusual design but makes sense IMO (screw middleboxes!) - "Before loading the channel file from disk, the Falcon sensor verifies that the file contents match the expected hash to detect any local modifications of the file." Sounds like a TOCTOU, but that's just a wild guess