8 ms·
Microsoft points finger at the EU for not being able to lock down Windows
- rlpb 2y ago"It's the EU's fault because they enabled competition who provided a more successful competing security product that our own security product"
- throwaway4pp24 2y agoA widely installed product doesn't imply a more successful product, and a more successful product doesn't imply a better product.
- rlpb 2y agoWhat does have to do with any level of failing on the part of the EU?
- throwaway4pp24 2y agoThat enabling competition in kernel mode antivirus is the actual problem, and that a more widely used product (which isn't true anyways, the MS product is used more) doesn't imply a better product.
- rlpb 2y ago> That enabling competition in kernel mode antivirus is the actual problem... That hasn't been demonstrated. Just because a competitor screws up in a competitive market doesn't mean that it is wrong to have competition. In a competitive market some competitors are expected to fail. It's part of the process.
- throwaway4pp24 2y agoYes indeed, it's expected - that confirms what I'm saying.
- lihli 2y ago[flagged]
- Woodi 2y ago> Microsoft agreed back in 2009 with the European Commission that it would give makers of security software the same level of access to Windows that Microsoft gets. Why Microsoft should have more access then others ? Becouse Crowdstrike / public internet straight to kernel updates combo ? Whole thing is about locking _computers_ from buyers and that is a no go. We need more os'es and more freedom - just fact of MS existence (domination) is a proof that hardware-os monopoly owned by one company is not some natural law. Now let's make IBM unlock their hardware-os monopoly to software vendors :)
- gmerc 2y agoStrangely Linux doesn’t have that problem.
- yijjb 2y ago[dead]
- gjsman-1000 2y ago> “The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers.” Which means, if Microsoft had made a more carefully scoped way of extending the kernel, or even avoided extending the kernel at all for their own security products, they would have perfectly been at liberty to demand it for everyone else.
- BLKNSLVR 2y ago"Current Microsoft points finger at Past Microsoft for ..." Isn't a headline that will ever exist, therefore they'll point fingers at any entity (EU being the most recent) that's making them do things they don't want to do in order to further an unrelated agenda. Let no catastrophe go unexploited, as they say.
- mikeocool 2y agoYeah — not to be an Apple fan boy or anything, but it appears in this case Apple did exactly that: https://support.apple.com/guide/deployment/system-and-kernel-extensions-in-macos-depa5fb8376f/web https://support.apple.com/guide/deployment/system-and-kernel... And made APIs available specifically for user-space EDR: https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity
- zokier 2y agoMicrosoft also has userspace APIs available, such as AMSI https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal https://learn.microsoft.com/en-us/windows/win32/amsi/antimal...
- Dwedit 2y agoSwitching from kernelspace to userspace on every file access would eat up so much performance it would be ridiculous.
- otterley 2y ago
- ern 2y agoWould a bad driver update potentially have had similar consequences? (real question) If so, this feels like a red herring.
- smallnamespace 2y agoDrivers undergo a vetting process by Microsoft (at least, the ones that are signed and offered as updates) = quality control through their control of the channel. This has been the case at least since the late 90s if I remember correctly.
- nullindividual 2y agoWHQL has had some pretty awful drivers pushed through it. Granted, this was quite some time ago, early 2000s-ish, but they've lead to BSODs etc with nVidia drivers.
- zinekeller 2y agoWell, it seems GPU driver fraud were (and is?) rampant: a snippet from Defrauding the WHQL driver certification process (2004, https://devblogs.microsoft.com/oldnewthing/20040305-00/?p=40373 https://devblogs.microsoft.com/oldnewthing/20040305-00/?p=40...) Some unscrupulous drivers will detect that they are being run by WHQL and disable various features so they pass certification. Of course, they also run dog slow in the WHQL lab, but that’s okay, because WHQL is interested in whether the driver contains any bugs, not whether the driver has the fastest triangle fill rate in the industry. The most common cheat I’ve seen is drivers which check for a secret “Enable Dubious Optimizations” switch in the registry or some other place external to the driver itself. They take the driver and put it in an installer which does not turn the switch on and submit it to WHQL. When WHQL runs the driver through all its tests, the driver is running in “safe but slow” mode and passes certification with flying colors. The vendor then takes that driver (now with the WHQL stamp of approval) and puts it inside an installer that enables the secret “Enable Dubious Optimizations” switch. Now the driver sees the switch enabled and performs all sorts of dubious optimizations, none of which were tested by WHQL.
- 2y ago
- altdataseller 2y agoGrewt, can the EU force Microsoft to open up their Linkedin API as well?
- jmclnx 2y ago>The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers I guess even M/S has a hard time with reading comprehension. "make available" does not mean "no lock down". So does that mean when someone boots windows into Safe Mode, they are breaking the law in the EU ? I do not think so.
- j45 2y agoBrainstorming - I wonder if there's a way for Microsoft to test builds of updates that could do this. It could still be hard to manage.
- OptionOfT 2y agoIf they start to lock it down it just becomes the next iOS. It's already horrible with their 'recommendations' left and right, and preinstalled stuff that you cannot remove. And then it just becomes too easy for Microsoft to let their Windows Defender run in kernel mode and 3rd parties can't do that, so obviously they can outperform them. Kinda like iOS' Safari. Hell, that one runs in user mode, but it required laws for 3rd parties to be able to provide native alternatives.
- Sakos 2y agoYeah, I don't understand what people want from Microsoft here. Either they lock it down completely, and we lose control of our Windows systems, which I thought was something people here were against, or they continue to allow kernel-level access, which can be and is pretty damn useful and I wouldn't give it up for the world. I like my Macbook, but I prefer my Windows desktop so much more because it still largely feels like my system instead of Apple's/Microsoft's. People. Stop asking Microsoft to lock down Windows.
- otterley 2y agoiOS is great! An OS that is secure by design arguably needs no third-party malware protection, and therefore there's nothing to permit.
- Sakos 2y agoIt also makes file management a bloody nightmare, so much so that I gave up on iPhone/iPad years ago and moved back to Android. There are trade-offs. I don't want Windows to just become another MacOS or even iOS where I'm so limited in what I'm allowed to do with my system.
- otterley 2y agoFile management? It's a phone. Besides, if you absolutely must manage a file store, there's a native iCloud Files integration now (https://support.apple.com/en-us/102570 https://support.apple.com/en-us/102570). The situation is a lot better than it used to be.
- timnetworks 2y agoWe all remember that Windows was a water-tight never-crash workhorse before the pesky EU stepped in and requested the APIs to be documented for once..
- bongodongobob 2y agoIn an enterprise setting where you can prevent people from fucking with it, it pretty much is. M365/office is the vast majority of our help desk tickets.
- croes 2y agoDon't you forget all the withdrawn updates MS released? MS isn't testing either.
- antisthenes 2y agoMy work laptop windows crashed more times in a year than my Windows 7 install in the 10 years that I was using it (2009-2019). Mostly due to Teams or Edge eating up all the memory, and the OS being unable to handle it gracefully.
- bongodongobob 2y agoYou're going to have issues on any OS if you're short on RAM, graceful or not.
- CRConrad 2y agoWhich makes RAM-eaters pretty much malware, doesn't it? And, as the GP says, the biggest RAM-eaters on most corporate Windows installs are... Microsoft corporate software, like Teams. So I find it pretty hard to take whatever Microsoft says as the last word on anti-malware, even on Windows, when it's at the same time the biggest purveyor of malware.
- al_borland 2y agoThis comment might have gone over better if people didn't just spend their whole weekend recovering from what is likely the largest outage in history, which only impacted Windows.
- justinclift 2y agoThat's funny. The Open Source Operating Systems that are around have much tighter security than Windows, yet their openness hasn't hurt them. Perhaps the problem is more with Microsoft than anything else?
- mc32 2y agoYes, funny... https://www.theregister.com/2024/07/21/crowdstrike_linux_crashes_restoration_tools/ https://www.theregister.com/2024/07/21/crowdstrike_linux_cra...
- justinclift 2y agoNot really sure what that's supposed to do with OS security? ClownStrike Falcon is famously flaky software on macOS and Linux. That's no surprise to anyone.
- snvzz 2y agoThe EU needs mandates to effectively exclude Windows from applications that are even slightly critical. As an aside, it is sickening that so many simple displays and dedicated devices with simple UIs that could be implemented as static scenarios using proper capability-based multiserver architectures (such as the leading seL4 / LionsOS) do instead use complicated software stacks based on Linux (and sometimes even worse, Windows).
- Jtsummers 2y ago> As an aside, it is sickening that so many simple displays and dedicated devices with simple UIs that could be implemented as static scenarios using proper capability-based multiserver architectures (such as the leading seL4 / LionsOS) do instead use complicated software stacks based on Linux (and sometimes even worse, Windows). This has been a thing since the 90s, maybe longer. I remember walking through Caesars Palace (Las Vegas, NV) circa 1999 and seeing a BSOD on several of their screens. People will always make expedient choices as long as it works well enough most of the time.
- Zamiel_Snawley 2y agoLionsOS looks super interesting, I’ve wanted to use seL4 for a while but it just seemed too difficult.
- userbinator 2y agoI absolutely hate this focus on "security"; it's just pushing us faster towards the authoritarian dystopia that Stallman warned us about 25+ years ago. This decision means security software vendors have a greater ability to muck up systems as CrowdStrike did this week when it crippled 8.5 million Windows PCs worldwide. ...and what about when Microsoft inevitably screws something up with its automatic updates and undoubtedly affects even more machines? They already have, multiple times. One of the most recent memorable occurrences: https://news.ycombinator.com/item?id=18189139 https://news.ycombinator.com/item?id=18189139 As the old saying goes, "Those who give up freedom for security deserve neither."
- colmmacc 2y agoI'm beyond skeptical that this competition regulation prevents Microsoft from say ... having Windows roll back to the last known version of a driver/extension after a failed boot (or several). Or from having a hyper-minimal super-nanny API that uses a signed network call to add a level of control over the loading process. Or from having a built-in phased rollout API that only permits a rollout to increase in scope as more confidence is gained. And probably ten more ideas! Microsoft didn't trigger this outage, but it's very worrying if they disown it. There's a lot the OS vendor can do.
- jborean93 2y ago> having Windows roll back to the last known version of a driver/extension after a failed boot (or several) One of the problems with CrowdStrike was the update was a definition/config file that was pushed out by CrowdStrike. There was no driver update and the BSOD was caused by the existing driver failing to parse/load the new file pushed out. This means there was no last known good state to rollback to in terms of driver updates. Granted I still agree that MS can hopefully improve things to avoid this problem in the future but this isn't a simple problem that the OS can guard from short of stopping 3rd party kernel drivers.
- colmmacc 2y agoFor robust rollback you need an encapsulation of the full dependency closure that can be rolled forwards and backwards atomically. These days containers are a decent enough solution for that. Anything changes means everything changes, at the same time. We have the technology.
- perryizgr8 2y ago> This means there was no last known good state to rollback to in terms of driver updates. Windows should unload the misbehaving driver after a couple of failed boots.
- jborean93 2y agoSure I can agree with this (if it's actually viable to do). My reply was mostly to try and explain that the issue wasn't due to a driver update but rather an existing driver failing to work with a new file it was using hence why the last known good configuration feature didn't work.
- tamimio 2y agoHey Microsoft: Just stop trying to cloudify everything in the new Windows and focus on its stability instead of releasing an inconsistent UI every few years, and you will be good to go.
- bulla 2y agoHow does Microsoft's deal with one country affect its software distribution in other countries?
- mkl95 2y agoDid the EU ask Microsoft to build leaky, fragile abstractions too? It sounds like Microsoft's architects are a bit too comfy.