3 ms·

> ”This is not a windows issue. This is a third party security vendor shitting in the kernel.“ Sure, but Windows shares some portion of the blame for allowing

> ”This is not a windows issue. This is a third party security vendor shitting in the kernel.“ Sure, but Windows shares some portion of the blame for allowing third-party security vendors to “shit in the kernel”. Compare to macOS which has banned third-party kernel extensions on Apple Silicon. Things that once ran as kernel extensions, including CrowdStrike, now run in userspace as “system extensions”.

corny_penguin88 2y ago
[dead]
deepsummer 2y ago
...but still, if the user space process is broken, MacOS will fail as well. Maybe it's a bit easier to recover, but any broken process with non-trivial privileges can interrupt the whole system.
- Reason077 2y ago
  It's certainly not supposed to work like that. In the kernel, a crash brings down the entire system by design. But in userspace, failed services can be restarted and continued without affecting other services. If a failure in a userspace service can crash the entire system, that's a bug.
  - deepsummer 2y ago
    It's kind of inevitable that a security system can crash the system. It just needs to claim than one essential binary is infected with malware, and the system won't run.
phendrenad2 2y ago
Yes... in the same sense that if a user bricks their own system by deleting system32 then Windows shares some small sliver of the blame. In other words, not much.
- OhMeadhbh 2y ago
  the difference is you can get most of the functionality you want without deleting system32, but if you want the super secure version of NT, you have to let idiots push untested code to your box. linux, Solaris, BSD and macOS aren't without their flaws, but MSFT could have done a much better job with system design.
- Reason077 2y ago
  Why should Windows let users delete system32? If they don't make it impossible to do so accidentally (or even maliciously), then I would indeed blame Windows. On macOS you can't delete or modify critical system files without both a root password and enough knowledge to disable multiple layers of hardware-enforced system integrity protection.
  - phendrenad2 2y ago
    lol. Never said they should, did I?
  - hobs 2y ago
    And what do you think installing a deep level antivirus across your entire fleet is equivalent to?
naib0930 2y ago
Back in 2006 the Microsoft agreed to allow kernel level access for Security companies due to an EU anti trust investigation. They were being sued by anti virus companies because they were blocking kernel access in the soon to be released Vista. https://arstechnica.com/information-technology/2006/10/7998/ https://arstechnica.com/information-technology/2006/10/7998/
- sam_lowry_ 2y ago
  Wow, that looks like a root cause
- Reason077 2y ago
  Wow! First cookie pop-ups, now Blue Friday...?
- syndeo 2y ago
  Sick and tired of EU meddling in tech. If third parties can muck around in the kernel, then there's nothing Microsoft can really do at that point. SMH
  - wooger 2y ago
    Can they simultaneously allow this, but recommend against it and deny support / sympathy if you do it to your OS?

corny_penguin88 2y ago

[dead]

deepsummer 2y ago

...but still, if the user space process is broken, MacOS will fail as well. Maybe it's a bit easier to recover, but any broken process with non-trivial privileges can interrupt the whole system.

Reason077 2y ago
It's certainly not supposed to work like that. In the kernel, a crash brings down the entire system by design. But in userspace, failed services can be restarted and continued without affecting other services. If a failure in a userspace service can crash the entire system, that's a bug.
- deepsummer 2y ago
  It's kind of inevitable that a security system can crash the system. It just needs to claim than one essential binary is infected with malware, and the system won't run.

phendrenad2 2y ago

Yes... in the same sense that if a user bricks their own system by deleting system32 then Windows shares some small sliver of the blame. In other words, not much.

OhMeadhbh 2y ago
the difference is you can get most of the functionality you want without deleting system32, but if you want the super secure version of NT, you have to let idiots push untested code to your box. linux, Solaris, BSD and macOS aren't without their flaws, but MSFT could have done a much better job with system design.
Reason077 2y ago
Why should Windows let users delete system32? If they don't make it impossible to do so accidentally (or even maliciously), then I would indeed blame Windows. On macOS you can't delete or modify critical system files without both a root password and enough knowledge to disable multiple layers of hardware-enforced system integrity protection.
- phendrenad2 2y ago
  lol. Never said they should, did I?
- hobs 2y ago
  And what do you think installing a deep level antivirus across your entire fleet is equivalent to?

naib0930 2y ago

Back in 2006 the Microsoft agreed to allow kernel level access for Security companies due to an EU anti trust investigation. They were being sued by anti virus companies because they were blocking kernel access in the soon to be released Vista. https://arstechnica.com/information-technology/2006/10/7998/ https://arstechnica.com/information-technology/2006/10/7998/

sam_lowry_ 2y ago
Wow, that looks like a root cause
Reason077 2y ago
Wow! First cookie pop-ups, now Blue Friday...?
syndeo 2y ago
Sick and tired of EU meddling in tech. If third parties can muck around in the kernel, then there's nothing Microsoft can really do at that point. SMH
- wooger 2y ago
  Can they simultaneously allow this, but recommend against it and deny support / sympathy if you do it to your OS?