3 ms·
> MacOS has the same problem as soon as they're deployed in large corporations. Except where Apple does not allow vendors loose in key places like the kernel.
by acdha 2y ago
> MacOS has the same problem as soon as they're deployed in large corporations.
Except where Apple does not allow vendors loose in key places like the kernel. One of the interesting questions here is whether Microsoft could possibly do that: Windows users would be better if the kernel was restricted to first-party code, things like AV used the same kind of interface which macOS has, and third-party code was forced into more moderated channels (malware uses many of the same techniques) – but there’s a security industry with revenue measured in tens of billions of dollars annually who would be running to the regulators if there was anything which could remotely be seen as favoring Defender over their products. I still think it’d be possible but hard enough that I’m not surprised they’ve slowly been letting awareness of the downsides build, especially on the enterprise IT side.
I was wondering whether this debacle might push them to have a roadmap for restricting kernel drivers in favor of the Windows eBPF implementation which has been approaching production grade. Sometimes you need a huge blowup to remove support for the status quo.
- nikcub 2y agoTechnically, they could do it - I believe Microsoft tried in the distant past. Problem is as soon as they restrict ring 0 to first-party only it would raise competition and antitrust issues and be seen as Microsoft favoring it's own solution and locking out third parties.
- WorldMaker 2y ago> I was wondering whether this debacle might push them to have a roadmap for restricting kernel drivers in favor of the Windows eBPF implementation which has been approaching production grade. Though as this article and its Red Hat respondents admit eBPF isn't a perfect solution either because it is still a somewhat Turing Complete scripting language and bad vendors will find ways to get kernel panics out of eBPF scripts no matter how hardened the eBPF driver gets. Microsoft is probably in a good position to use this debacle to push more vendors to Windows' implementation of eBPF. It doesn't solve the crisis that a vendor like CrowdStrike exists that is "beloved" by Enterprise Solution Architects for all the compliance boxes it checks, but is run as a terrible software company with bad standards and has multiple "accidents" in recent weeks.
- acdha 2y agoYeah, I’m not saying eBPF is perfect but it’s getting better and has a path to making things much safer. I’d compare that to where things were with memory safety 20 years ago where it seemed unlikely that anything could displace C/C++ but by now we’re seeing a lot of important things written in memory safe languages. For a company with Microsoft’s resources, I’d imagine they could do quite a lot if 10% of the CEO’s bonus was instead invested in making their customers safer.