12 ms·

As I was reading this article I kept thinking to myself "Microsoft is going to boot Firefox from Windows" before realizing that MS doesn't have that sort of pow

As I was reading this article I kept thinking to myself "Microsoft is going to boot Firefox from Windows" before realizing that MS doesn't have that sort of power (compared to say Apple). It's really interesting how MS will approach this. Unlike Apple, MS doesn't have direct control over which apps go on the operating system, they aren't even in a position like Google where their app store is the dominant platform for getting apps. This will be interesting, interesting to see how MS responds. Will they give in and let users easily set their default browser or will this turn into a cat and mouse game. Lastly I think what MS is doing with the default browser is foolish. Did they learn nothing from the antitrust cases of the 2000's

barryvan 5y ago
I suspect they will buckle -- but only partially, with an allowlist of browsers blessed with this ability. This will quiet the noise, but will also make it harder for small and innovative browsers to compete, as I doubt Microsoft will build out the processes to become blessed due to cost/benefit.
- bluGill 5y ago
  Probably, but for security reasons the only correct thing to do is remove the ability of Edge to set default browser within the browser. The only option app developers - including internal Microsoft ones - should have is open some OS settings app in a supported way, but the user has to accept the selection.
  - blendergeek 5y ago
    It should work like an Android permission prompt. The OS should have an official method for apps to request to become the default (not merely link to the default apps page of settings). The OS prompt should look like this: Would you like to make <APP NAME> the default app for <APP CATEGORY>? [No and don't ask again] [Yes] Any app that wants to become the default (including Edge) should go through the official prompt. If the user has already said no, and the app wants to continue nagging, at this point the app will be able to link into the settings (but not pop up the official prompt).
- heavyset_go 5y ago
  This seems to be an industry-wide trend. Google, somewhat recently, also banned "unauthorized" browsers from logging into Google accounts at all.
  - account42 5y ago
    All browsers already claim to be "Mozilla" so it's not like there is no way to work around that.
    - heavyset_go 5y ago
      They're doing far more when fingerprinting browsers than looking at the User-Agent.
anothernewdude 5y ago
That's silly. Chrome has become so dominant that it'd be a good move on MS's part to help segment the browser market by supporting Firefox
- joncrane 5y ago
  Isn't Google the single largest contributor to the Mozilla Foundation?
  - boomboomsubban 5y ago
    No. The Mozilla Corporation is the largest contributor to the Mozilla Foundation, though most of their money comes from selling the default search rights to Google.
    - pbhjpbhj 5y ago
      That sounds like '"yes" but I don't like to admit it'. I mean their money comes from the bank account that others pay in to, but that's a stupid and irrelevant distinction ...
      - LanceH 5y ago
        His point is that Google is a customer, not a contributor.
        e3bc54b2 5y ago
        Which in this case is equivalent to 'if you owe 10k to Bank its your problem, but if you owe 10M its the bank's problem'. One way or another Mozilla relies on Google remaining its customer for vast majority of money, while Google being their biggest competitor who eats out ever more of Mozilla's market share every year, further reducing any reason for Google to remain their customer going forward.
        5y ago
orbital-decay 5y ago
Microsoft were doing this for ages... From the NT kernel to the shell. To stay above competition, they have tons of different undocumented APIs they keep for themselves to use, and don't guarantee it to exist or stay unchanged in future. In fact this is the response. Nothing special about this particular one. Developers reverse engineer those, and try to rely on them, all the time.
- kmeisthax 5y ago
  Every OS and library has some form of undocumented/internal APIs that they don't want users of that library or OS to be relying upon. Hell, Linux even uses DRM (not the Direct Rendering Manager, Digital Rights Management) to check if your LKM is licensed properly to call those APIs. GPL-incompatible libraries only get to link to functions that are rough equivalents to syscalls.
  - pbhjpbhj 5y ago
    Calling what you describe DRM is pretty deceptive. Can you get access to DRM-ed materials by promising to share them freely under an open license? That said I'm surprised by what you describe as I'm struggling to understand how that works -- you're saying the Linux kernel has a secret API, surely one can read the source and/or documentation and find the API details. Or are you saying calls to kernel APIs are cryptographically protected? Could you give details of what this system is called, thanks.
    - icefo 5y ago
      The zfsonlinux developers complained a while ago that some API they were using became GPL only and I think they had to write a wrapper in GPL to get around it. I'm on mobile so I can't give you more details but you can probably find more if you look in that direction
      - vetinari 5y ago
        It was API, not API key. Kernel is GPL, so only GPL modules can touch its internal APIs. For non-derived works, there is a subset of APIs, that are declared to be fine if used by non-GPL code. ZFS had a problem, where they were using something that should not be used (fp in kernel), which got removed and they had to find a replacement, which was GPL-only. It is also necessary to say, that this is honor-based. Any module declares its license and the linker either allows or not allows resolving a symbol. There are no checks whether the module is really GPL or not, it is to show intent, and if you want to cheat, you must do it willfully, not by accident.
ilaksh 5y ago
They do have some control though. If you don't list with their app store they default to accusing your software of being malware and hiding the run button.
- whywhywhywhy 5y ago
  > and hiding the run button This isn't completely accurate, if the app is being seen only in very small numbers the run button is hidden under "More Info" but when Smartscreen has seen your app enough that it can be more confident it's less harmful the "Run Anyway" button is surfaced.
- garaetjjte 5y ago
  That's not related to app store though, just the CA protection racket.
  - ilaksh 5y ago
    It is because they waive the CA if you go through the store.
pc86 5y ago
My guess is they'll just leave it. You'll have the one-click for Edge, whatever this workaround/RE is for Firefox, and everything else will be the same. Maybe Mozilla will open source this workaround.
- iggldiggl 5y ago
  They'd have to go out of their way to not open-source it.
2OEH8eoCRo0 5y ago
> Did they learn nothing from the antitrust cases of the 2000's They learned for awhile- until the rest of the industry caught up. This might sound weird but I've actually been rooting for Microsoft a lot lately. A majority of their revenue is not from ads and lock-in BS and they weren't called in front of Congress recently over antitrust concerns. I was hoping they would set themselves apart from the pack in an odd way by making good software and hardware products that people enjoy using. (xbox, windows, office, WSL, VSCode, Visual Studio, hololens, phones, laptops, Halo on Steam, etc.) Seeing the new browser war and direction Windows 11 is headed, now has me worried. The widgets pane is obviously for serving ads. I understand that these public companies are required to act in the best interests of shareholders but I fear that the obsessive push for revenue gains only benefits short term shareholders. Long term shareholders get the shaft when every decision is aimed at squeezing revenue just for the next quarter. Edit: I'm not a Microsoft/Windows-Stan either, I've been using Linux intermittently since 2006-ish and now daily drive Fedora as my main.
- bayindirh 5y ago
  I was also kinda liked The New Microsoft and prepared to put my anger towards them to the side (I remember the ACPI memo days). Also, as a grown-up computer user, I got appropriate number of licenses (for every Microsoft application we use) for my family and personal computers. However, the latest GitHub Copilot stuff, their agreement with OpenAI, return of their embrace, extend, extinguish tactics with GitHub, VSCode and other stuff undone everything. It's their DNA now. All Microsoft Empire is built with crushing monopoly as their core value and driving force. Changing this requires more than changing a mere CEO and posting a "We Love Linux" banner. The only really good thing they do is hardware. Posted from my Debian 11 box using Microsoft Keyboard.
  - flatiron 5y ago
    I recently left Apple and my new company gave me a choice of windows or macOS as my device and I chose windows. I’m not really sure why. But I do have to say after not using windows for 10+ years it’s come a long way. Wsl simply is amazing. Vscode works perfectly with it. The office apps are leaps and bounds better than there macOS counterparts. I certainly have never been a MS lover but I think they are much better now than their 90s reputation.
Angostura 5y ago
> MS doesn't have that sort of power (compared to say Apple) That's an interesting question. I suppose Apple could refuse to sign the executable, which would make things tricky but could they actually boot Firefox from MacOS? I think not.
- cma 5y ago
  Yes, remember this? > Apple has released a silent update for Mac users removing a vulnerable component in Zoom Removed not by antivirus you can disable, removed by an OS update.
  - Angostura 5y ago
    Do I remember Apple updating XProtect to remove a Zoom component that allowed attackers to potentially hijack users' webcams? I do. Zoom had installed a hidden web server on users' computers that was (a) exploitable and (b) not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack. Zoom worked with Apple and updated the app hours later. You can kill XProtect if you want by disabling System Integrity Protection and modifying the malware signature file.
vishnumohandas 5y ago
> Apple FWIW, on iOS, links from Google apps open up on Chrome if it's installed, regardless of what your default browser is. Apple seems to be okay with that.
- dev_tty01 5y ago
  Any app can do app specific URLs on iOS to invoke particular apps with content. I would guess that Google apps detect the presence of Chrome and modify the URLs to be Chrome specific rather than generic https URLs. Its ok with Apple because that is a standard supported mechanism on iOS.
  - vishnumohandas 5y ago
    As a user who expects all https links to open within my default browser, Google's exploitation of this workaround breaks the guarantees I expect out of the OS. There are a lot of other "features" that are technically feasible but not allowed on AppStore. This to me should have been on that list.
    - dev_tty01 5y ago
      Good point. Yeah, I don't like it either. Thinking about it a bit more, I share your surprise that they allowed this. I guess they need it for google.com links to make things work together, but Apple could have told them non-google links should be opened in the default browser.
- heavyset_go 5y ago
  Any browser on iOS is just UI over Safari's rendering engine and JS runtime. Chrome, as in Blink and V8, is banned by Apple from running on iOS.
cabalamat 5y ago
> This will be interesting, interesting to see how MS responds Maybe they'll make a better browser, so people will prefer theirs to Firefox and Chrome? Nah, that's unlikely.
- pbhjpbhj 5y ago
  That can just cripple Office.com to browsers other than Edge, then it looks like they have a better browser -- much easier!
- worrycue 5y ago
  To be fair, Edge is basically just Chrome now no? It isn’t too bad although I stuck to Firefox.
  - cabalamat 5y ago
    > Edge is basically just Chrome now no? Exactly. MS have given up on the idea of making a better browser.
ocdtrekkie 5y ago
I suspect Microsoft will modify their undocumented API that they have no obligation to maintain as-is so that it only accepts EXEs in Edge's program folder or something.
boomboomsubban 5y ago
>that MS doesn't have that sort of power (compared to say Apple). They could mark the install executable as malicious in Windows Defender.
- pbhjpbhj 5y ago
  Or the domain as having PUP so people visiting get a warning and hoops to jump through.
- bogwog 5y ago
  Which is similar to what Apple does for MacOS (and Google for Android). They haven't prevented people from installing untaxed software, but they have made it a scary and difficult process for the average user, and made it very difficult for anyone to sell software without giving Apple/Google a cut.
  - cma 5y ago
    And they said desktop signing was only for security, then blocked Epic's desktop apps for an iOS non-security business dispute.
- account42 5y ago
  It would be funny if Firefox would warn you about downloading Firefox because it is marked as malware. Would server Mozilla right for letting Google maintain that list, who have shown they do not care about false positives.
dev_tty01 5y ago
Of course Apple allows Mac users to set the default browser as a choice on the very first General preferences panel. Trivial to change.
- sitzkrieg 5y ago
  yea the flawless mac experience, what next being able to uninstall apple music or podcasts?
jonnycomputer 5y ago
I can install apps on Mac that aren't in the store.
- deleted 5y ago
  [deleted]
zaat 5y ago
So I was at my parents house some time ago and my mom's computer is for some reason set allow installing software from the Microsoft store only. Nobody knows how that was set, my mom's computer usage is characterized by randomly clicking on things until the website she wants open, but somehow that option have appeared for her to click on.
- criley2 5y ago
  Windows 10S only allows Microsoft Store downloads and you have to change to Home/Pro to allow .exe's to run at all.
Iv 5y ago
> Did they learn nothing from the antitrust cases of the 2000's They learnt that all they risk is a slap on the wrist a decade later, and a fee that's a drop in their profits.
tgtweak 5y ago
Just wait for those "store-only" versions of windows to grow in distribution, then Microsoft touting store policy for not allowing Firefox in the store...
heavyset_go 5y ago
> I kept thinking to myself "Microsoft is going to boot Firefox from Windows" before realizing that MS doesn't have that sort of power (compared to say Apple). Actually, when it comes to Windows and macOS, Microsoft has about the same power as Apple does when it comes to limiting what software can and can't run on their operating systems. Defender on Windows works like Gatekeeper does on macOS. Defender gets to decide what runs or doesn't run on a Windows system, using a similar approach to Gatekeeper. Both Apple and Microsoft require developers to regularly buy certificates to sign the software they intend to distribute to macOS and Windows users, and they require developers to remain in good standing with either company. Unsigned software is treated as if it is radioactive by both operating systems, and macOS on M1 Macs goes one step further by deprecating unsigned binaries entirely. If Apple or Microsoft want to, they can revoke a developer's certificates, and any app that was signed with them will be prevented from running by Gatekeeper or Defender. They can also choose not to renew a developer's certificates, preventing apps from running when the certificates they were signed with expire. To 99.9% of users, apps signed with revoked or expired certificates will be portrayed as either being broken or malicious by macOS or Windows.

barryvan 5y ago

I suspect they will buckle -- but only partially, with an allowlist of browsers blessed with this ability. This will quiet the noise, but will also make it harder for small and innovative browsers to compete, as I doubt Microsoft will build out the processes to become blessed due to cost/benefit.

bluGill 5y ago
Probably, but for security reasons the only correct thing to do is remove the ability of Edge to set default browser within the browser. The only option app developers - including internal Microsoft ones - should have is open some OS settings app in a supported way, but the user has to accept the selection.
- blendergeek 5y ago
  It should work like an Android permission prompt. The OS should have an official method for apps to request to become the default (not merely link to the default apps page of settings). The OS prompt should look like this: Would you like to make <APP NAME> the default app for <APP CATEGORY>? [No and don't ask again] [Yes] Any app that wants to become the default (including Edge) should go through the official prompt. If the user has already said no, and the app wants to continue nagging, at this point the app will be able to link into the settings (but not pop up the official prompt).
heavyset_go 5y ago
This seems to be an industry-wide trend. Google, somewhat recently, also banned "unauthorized" browsers from logging into Google accounts at all.
- account42 5y ago
  All browsers already claim to be "Mozilla" so it's not like there is no way to work around that.
  - heavyset_go 5y ago
    They're doing far more when fingerprinting browsers than looking at the User-Agent.

anothernewdude 5y ago

That's silly. Chrome has become so dominant that it'd be a good move on MS's part to help segment the browser market by supporting Firefox

joncrane 5y ago
Isn't Google the single largest contributor to the Mozilla Foundation?
- boomboomsubban 5y ago
  No. The Mozilla Corporation is the largest contributor to the Mozilla Foundation, though most of their money comes from selling the default search rights to Google.
  - pbhjpbhj 5y ago
    That sounds like '"yes" but I don't like to admit it'. I mean their money comes from the bank account that others pay in to, but that's a stupid and irrelevant distinction ...
    - LanceH 5y ago
      His point is that Google is a customer, not a contributor.
      - e3bc54b2 5y ago
        Which in this case is equivalent to 'if you owe 10k to Bank its your problem, but if you owe 10M its the bank's problem'. One way or another Mozilla relies on Google remaining its customer for vast majority of money, while Google being their biggest competitor who eats out ever more of Mozilla's market share every year, further reducing any reason for Google to remain their customer going forward.
        5y ago

orbital-decay 5y ago

Microsoft were doing this for ages... From the NT kernel to the shell. To stay above competition, they have tons of different undocumented APIs they keep for themselves to use, and don't guarantee it to exist or stay unchanged in future. In fact this is the response. Nothing special about this particular one. Developers reverse engineer those, and try to rely on them, all the time.

kmeisthax 5y ago
Every OS and library has some form of undocumented/internal APIs that they don't want users of that library or OS to be relying upon. Hell, Linux even uses DRM (not the Direct Rendering Manager, Digital Rights Management) to check if your LKM is licensed properly to call those APIs. GPL-incompatible libraries only get to link to functions that are rough equivalents to syscalls.
- pbhjpbhj 5y ago
  Calling what you describe DRM is pretty deceptive. Can you get access to DRM-ed materials by promising to share them freely under an open license? That said I'm surprised by what you describe as I'm struggling to understand how that works -- you're saying the Linux kernel has a secret API, surely one can read the source and/or documentation and find the API details. Or are you saying calls to kernel APIs are cryptographically protected? Could you give details of what this system is called, thanks.
  - icefo 5y ago
    The zfsonlinux developers complained a while ago that some API they were using became GPL only and I think they had to write a wrapper in GPL to get around it. I'm on mobile so I can't give you more details but you can probably find more if you look in that direction
    - vetinari 5y ago
      It was API, not API key. Kernel is GPL, so only GPL modules can touch its internal APIs. For non-derived works, there is a subset of APIs, that are declared to be fine if used by non-GPL code. ZFS had a problem, where they were using something that should not be used (fp in kernel), which got removed and they had to find a replacement, which was GPL-only. It is also necessary to say, that this is honor-based. Any module declares its license and the linker either allows or not allows resolving a symbol. There are no checks whether the module is really GPL or not, it is to show intent, and if you want to cheat, you must do it willfully, not by accident.

ilaksh 5y ago

They do have some control though. If you don't list with their app store they default to accusing your software of being malware and hiding the run button.

whywhywhywhy 5y ago
> and hiding the run button This isn't completely accurate, if the app is being seen only in very small numbers the run button is hidden under "More Info" but when Smartscreen has seen your app enough that it can be more confident it's less harmful the "Run Anyway" button is surfaced.
garaetjjte 5y ago
That's not related to app store though, just the CA protection racket.
- ilaksh 5y ago
  It is because they waive the CA if you go through the store.

pc86 5y ago

My guess is they'll just leave it. You'll have the one-click for Edge, whatever this workaround/RE is for Firefox, and everything else will be the same. Maybe Mozilla will open source this workaround.

iggldiggl 5y ago
They'd have to go out of their way to not open-source it.

2OEH8eoCRo0 5y ago

> Did they learn nothing from the antitrust cases of the 2000's They learned for awhile- until the rest of the industry caught up. This might sound weird but I've actually been rooting for Microsoft a lot lately. A majority of their revenue is not from ads and lock-in BS and they weren't called in front of Congress recently over antitrust concerns. I was hoping they would set themselves apart from the pack in an odd way by making good software and hardware products that people enjoy using. (xbox, windows, office, WSL, VSCode, Visual Studio, hololens, phones, laptops, Halo on Steam, etc.) Seeing the new browser war and direction Windows 11 is headed, now has me worried. The widgets pane is obviously for serving ads. I understand that these public companies are required to act in the best interests of shareholders but I fear that the obsessive push for revenue gains only benefits short term shareholders. Long term shareholders get the shaft when every decision is aimed at squeezing revenue just for the next quarter. Edit: I'm not a Microsoft/Windows-Stan either, I've been using Linux intermittently since 2006-ish and now daily drive Fedora as my main.

bayindirh 5y ago
I was also kinda liked The New Microsoft and prepared to put my anger towards them to the side (I remember the ACPI memo days). Also, as a grown-up computer user, I got appropriate number of licenses (for every Microsoft application we use) for my family and personal computers. However, the latest GitHub Copilot stuff, their agreement with OpenAI, return of their embrace, extend, extinguish tactics with GitHub, VSCode and other stuff undone everything. It's their DNA now. All Microsoft Empire is built with crushing monopoly as their core value and driving force. Changing this requires more than changing a mere CEO and posting a "We Love Linux" banner. The only really good thing they do is hardware. Posted from my Debian 11 box using Microsoft Keyboard.
- flatiron 5y ago
  I recently left Apple and my new company gave me a choice of windows or macOS as my device and I chose windows. I’m not really sure why. But I do have to say after not using windows for 10+ years it’s come a long way. Wsl simply is amazing. Vscode works perfectly with it. The office apps are leaps and bounds better than there macOS counterparts. I certainly have never been a MS lover but I think they are much better now than their 90s reputation.

Angostura 5y ago

> MS doesn't have that sort of power (compared to say Apple) That's an interesting question. I suppose Apple could refuse to sign the executable, which would make things tricky but could they actually boot Firefox from MacOS? I think not.

cma 5y ago
Yes, remember this? > Apple has released a silent update for Mac users removing a vulnerable component in Zoom Removed not by antivirus you can disable, removed by an OS update.
- Angostura 5y ago
  Do I remember Apple updating XProtect to remove a Zoom component that allowed attackers to potentially hijack users' webcams? I do. Zoom had installed a hidden web server on users' computers that was (a) exploitable and (b) not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack. Zoom worked with Apple and updated the app hours later. You can kill XProtect if you want by disabling System Integrity Protection and modifying the malware signature file.

vishnumohandas 5y ago

> Apple FWIW, on iOS, links from Google apps open up on Chrome if it's installed, regardless of what your default browser is. Apple seems to be okay with that.

dev_tty01 5y ago
Any app can do app specific URLs on iOS to invoke particular apps with content. I would guess that Google apps detect the presence of Chrome and modify the URLs to be Chrome specific rather than generic https URLs. Its ok with Apple because that is a standard supported mechanism on iOS.
- vishnumohandas 5y ago
  As a user who expects all https links to open within my default browser, Google's exploitation of this workaround breaks the guarantees I expect out of the OS. There are a lot of other "features" that are technically feasible but not allowed on AppStore. This to me should have been on that list.
  - dev_tty01 5y ago
    Good point. Yeah, I don't like it either. Thinking about it a bit more, I share your surprise that they allowed this. I guess they need it for google.com links to make things work together, but Apple could have told them non-google links should be opened in the default browser.
heavyset_go 5y ago
Any browser on iOS is just UI over Safari's rendering engine and JS runtime. Chrome, as in Blink and V8, is banned by Apple from running on iOS.

cabalamat 5y ago

> This will be interesting, interesting to see how MS responds Maybe they'll make a better browser, so people will prefer theirs to Firefox and Chrome? Nah, that's unlikely.

pbhjpbhj 5y ago
That can just cripple Office.com to browsers other than Edge, then it looks like they have a better browser -- much easier!
worrycue 5y ago
To be fair, Edge is basically just Chrome now no? It isn’t too bad although I stuck to Firefox.
- cabalamat 5y ago
  > Edge is basically just Chrome now no? Exactly. MS have given up on the idea of making a better browser.

ocdtrekkie 5y ago

I suspect Microsoft will modify their undocumented API that they have no obligation to maintain as-is so that it only accepts EXEs in Edge's program folder or something.

boomboomsubban 5y ago

>that MS doesn't have that sort of power (compared to say Apple). They could mark the install executable as malicious in Windows Defender.

pbhjpbhj 5y ago
Or the domain as having PUP so people visiting get a warning and hoops to jump through.
bogwog 5y ago
Which is similar to what Apple does for MacOS (and Google for Android). They haven't prevented people from installing untaxed software, but they have made it a scary and difficult process for the average user, and made it very difficult for anyone to sell software without giving Apple/Google a cut.
- cma 5y ago
  And they said desktop signing was only for security, then blocked Epic's desktop apps for an iOS non-security business dispute.
account42 5y ago
It would be funny if Firefox would warn you about downloading Firefox because it is marked as malware. Would server Mozilla right for letting Google maintain that list, who have shown they do not care about false positives.

dev_tty01 5y ago

Of course Apple allows Mac users to set the default browser as a choice on the very first General preferences panel. Trivial to change.

sitzkrieg 5y ago
yea the flawless mac experience, what next being able to uninstall apple music or podcasts?

jonnycomputer 5y ago

I can install apps on Mac that aren't in the store.

deleted 5y ago
[deleted]

zaat 5y ago

So I was at my parents house some time ago and my mom's computer is for some reason set allow installing software from the Microsoft store only. Nobody knows how that was set, my mom's computer usage is characterized by randomly clicking on things until the website she wants open, but somehow that option have appeared for her to click on.

criley2 5y ago
Windows 10S only allows Microsoft Store downloads and you have to change to Home/Pro to allow .exe's to run at all.

Iv 5y ago

> Did they learn nothing from the antitrust cases of the 2000's They learnt that all they risk is a slap on the wrist a decade later, and a fee that's a drop in their profits.

tgtweak 5y ago

Just wait for those "store-only" versions of windows to grow in distribution, then Microsoft touting store policy for not allowing Firefox in the store...

heavyset_go 5y ago

> I kept thinking to myself "Microsoft is going to boot Firefox from Windows" before realizing that MS doesn't have that sort of power (compared to say Apple). Actually, when it comes to Windows and macOS, Microsoft has about the same power as Apple does when it comes to limiting what software can and can't run on their operating systems. Defender on Windows works like Gatekeeper does on macOS. Defender gets to decide what runs or doesn't run on a Windows system, using a similar approach to Gatekeeper. Both Apple and Microsoft require developers to regularly buy certificates to sign the software they intend to distribute to macOS and Windows users, and they require developers to remain in good standing with either company. Unsigned software is treated as if it is radioactive by both operating systems, and macOS on M1 Macs goes one step further by deprecating unsigned binaries entirely. If Apple or Microsoft want to, they can revoke a developer's certificates, and any app that was signed with them will be prevented from running by Gatekeeper or Defender. They can also choose not to renew a developer's certificates, preventing apps from running when the certificates they were signed with expire. To 99.9% of users, apps signed with revoked or expired certificates will be portrayed as either being broken or malicious by macOS or Windows.