3 ms·

> Back in 2009, Microsoft agreed to interoperability rules that provide third-party security apps with the same level of access to Windows that Microsoft gets.

> Back in 2009, Microsoft agreed to interoperability rules that provide third-party security apps with the same level of access to Windows that Microsoft gets. Microsoft agreed to provide kernel access in order to resolve multiple longstanding competition law issues in Europe. > Apple has not been forced to make changes to how Macs work, but the European Commission has been targeting the closed nature of iOS, and Apple has warned that the updates that have already been implemented could lead to security risks in the future. This is a valid and interesting comparison - Microsoft complied and Apple fought tooth and nail. But also, it's kind of a moot point because absolutely no one is running Apple hardware at a flight kiosk.

bilbo0s 2y ago
Just Devils advocate, but, If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited. I’m not sure it’s gonna hamper things legally too much to let MS, and everyone else for that matter, Apple, Linux, Android, whoever, erect defensive walls around their own kernels. This is just security 101 for devices these days, and it doesn’t stop anyone else from participating in the windows, android, apple ecosystem.
- lazide 2y ago
  The issue is Defender and equivalents. Those would have access of course, and hence have an extreme competitive advantage relative to other products. Even more than they do now. Kiss any non-Microsoft antivirus or security software goodbye.
  - Rinzler89 2y ago
    >The issue is Defender and equivalents. Not just that, but that would break backwards compatibility with a lot of niche but important apps, since Windows was very popular with use cases where companies have developed kernel space drivers for their Windows products. Yanking that away for security with break backwards compatibility.
    - lazide 2y ago
      Are you talking hardware drivers or something else?
  - whimsicalism 2y ago
    I think userspace AV would work fine for 99%+ of usecases, not some extreme competitive advantage.
    - lazide 2y ago
      Not even close - real time memory scanning? Suspicious memory access detection? Suspicious file access detection? Suspicious network traffic? Suspicious kernel calls? Introspection on running program code? It’s already a major performance impact, throwing it into user space would kill those products entirely.
      - whimsicalism 2y ago
        what mac AVs support this?
        lazide 2y ago
        Mac’s are a tiny segment of the business market, and hence get almost none of the attention from attacks.
- CRConrad 2y ago
  > Just Devils advocate, but, But misguided, as usual when someone defends Microsoft. > If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited They are allowed to protect “their kernel”. (And / or everything else, which AFAIK is what anti-virus software is supposed to do.) It's just that they're only allowed to do it the same way they allow everyone else to do the same thing. So, being the lazy arseholes they are, they let everyone else into the kernel like they do it, in stead of doing what they should have done: Do it from userspace like anti-virus software used to work, or build a secure API that lets software protect the kernel without being able to take it down / prevent it from booting up — and use that API themselves, in their own separate anti-virus product. Then that product would have been on an even footing in the marketplace with its competitors, which is what the agreement with the EU sought to achieve. But Microsoft cheaped out and took the easier, cheaper — and riskier! — route. This debacle is as much on them as on Crowdstrike.
isodev 2y ago
This is ridiculous though. Nothing is stopping Microsoft from offering “safe” access to both themselves and third parties. Also, let’s not forget why these restrictions are applied in the first place - they kick in when the corp grows to become a gatekeeper, integrating multiple product categories and the expense of users and 3rd party vendors.
- Rinzler89 2y ago
  >Nothing is stopping Microsoft from offering “safe” access to both themselves and third parties. They are offering "safe" access, it's called userspace.
  - isodev 2y ago
    Then the blame can safely go to the vendor who opted not to take advantage. If anything, the Crowdstrike incident highlights the lack of diversity in the OS/security space. Everyone using the same stack makes everyone vulnerable to the same bugs.
  - MobiusHorizons 2y ago
    You can’t write programs like CrowdStrike falcon in user space on windows, because windows doesn’t offer the right kind of APIs and hooks from userspace to provide that kind of protection. On Mac OS CrowdStrike falcon runs in userspace already, and on Linux, the kernel interface is provided by eBPF, which acts as a sandbox, preventing certain classes of crash. So it really is true that Microsoft does not provide safe access like other operating systems do.
    - Rinzler89 2y ago
      Does the MacOS Falcon app running in userspace have the exact same monitoring capability like the Windows variant running in kernel space?
    - rawicki 2y ago
      Nothing stops them from writing a minimal kernelspace driver that sends events to the userspace part and evaluates rules there.
noahtallen 2y ago
Well, last point isn’t quite true. Alaska Airlines is primarily iOS. So, iPads scan your boarding pass and are used for printing luggage tags outside security, Flight attendants use iPhones on the planes, etc. And they were of course mostly unaffected by the Cloudstrike outage. Either way, I think it’s a strong point for Apple that antivirus is not required because the iOS security model protects against viruses pretty thoroughly. That’s just not the case for Windows most of the time. Also, do tech companies run antivirus on their linux-based containerized cloud workflows? Not really, the security model doesn’t require it. Points against windows server here
- legitster 2y ago
  This is incorrect: Alaska Airlines wasn't a Crowdstrike customer. They use SentinalOne, a competitor. They absolutely use Windows desktop environments across their infrastructure.
- jeroenhd 2y ago
  CrowdStrike is deployed on Linux servers as well, so clearly companies like these do run EDR software on their Linux hosts. Apple pretends they don't need antivirus the same way some Linux advocates will, but viruses exist on both platforms. Very few companies run their digital signage or internal application databases on macOS hosts, mostly because Apple stepped out of that market years ago. Whenever Apple or Linux are deployed at the scale these CrowdStrike desktops are, you can assume similar software is deployed on any platform. This time it was a kernel crash, next time it could be MDM software locking all iPads out of all network access, or null routing all I/O requests in eBPF.
  - deleted 2y ago
    [deleted]
  - throw0101d 2y ago
    > Apple pretends they don't need antivirus the same way some Linux advocates will, but viruses exist on both platforms. Sure. But when was the last time a company was in the news when they were hit with macOS-, iOS-, or Linux-based ransomware? I'm in IT, but Windows was never my thing/niche. Generally I've viewed two problems with it: 1. when it becomes a monoculture where basically everything in the company runs on it 2. something about its architecture/designs appears (to me, at least) for very easy spreading of malware (does it have some weaker SSH-equivalent that allows easy remote control?) Just ask Maersk about these two points: * https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

bilbo0s 2y ago

Just Devils advocate, but, If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited. I’m not sure it’s gonna hamper things legally too much to let MS, and everyone else for that matter, Apple, Linux, Android, whoever, erect defensive walls around their own kernels. This is just security 101 for devices these days, and it doesn’t stop anyone else from participating in the windows, android, apple ecosystem.

lazide 2y ago
The issue is Defender and equivalents. Those would have access of course, and hence have an extreme competitive advantage relative to other products. Even more than they do now. Kiss any non-Microsoft antivirus or security software goodbye.
- Rinzler89 2y ago
  >The issue is Defender and equivalents. Not just that, but that would break backwards compatibility with a lot of niche but important apps, since Windows was very popular with use cases where companies have developed kernel space drivers for their Windows products. Yanking that away for security with break backwards compatibility.
  - lazide 2y ago
    Are you talking hardware drivers or something else?
- whimsicalism 2y ago
  I think userspace AV would work fine for 99%+ of usecases, not some extreme competitive advantage.
  - lazide 2y ago
    Not even close - real time memory scanning? Suspicious memory access detection? Suspicious file access detection? Suspicious network traffic? Suspicious kernel calls? Introspection on running program code? It’s already a major performance impact, throwing it into user space would kill those products entirely.
    - whimsicalism 2y ago
      what mac AVs support this?
      - lazide 2y ago
        Mac’s are a tiny segment of the business market, and hence get almost none of the attention from attacks.
CRConrad 2y ago
> Just Devils advocate, but, But misguided, as usual when someone defends Microsoft. > If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited They are allowed to protect “their kernel”. (And / or everything else, which AFAIK is what anti-virus software is supposed to do.) It's just that they're only allowed to do it the same way they allow everyone else to do the same thing. So, being the lazy arseholes they are, they let everyone else into the kernel like they do it, in stead of doing what they should have done: Do it from userspace like anti-virus software used to work, or build a secure API that lets software protect the kernel without being able to take it down / prevent it from booting up — and use that API themselves, in their own separate anti-virus product. Then that product would have been on an even footing in the marketplace with its competitors, which is what the agreement with the EU sought to achieve. But Microsoft cheaped out and took the easier, cheaper — and riskier! — route. This debacle is as much on them as on Crowdstrike.

isodev 2y ago

This is ridiculous though. Nothing is stopping Microsoft from offering “safe” access to both themselves and third parties. Also, let’s not forget why these restrictions are applied in the first place - they kick in when the corp grows to become a gatekeeper, integrating multiple product categories and the expense of users and 3rd party vendors.

Rinzler89 2y ago
>Nothing is stopping Microsoft from offering “safe” access to both themselves and third parties. They are offering "safe" access, it's called userspace.
- isodev 2y ago
  Then the blame can safely go to the vendor who opted not to take advantage. If anything, the Crowdstrike incident highlights the lack of diversity in the OS/security space. Everyone using the same stack makes everyone vulnerable to the same bugs.
- MobiusHorizons 2y ago
  You can’t write programs like CrowdStrike falcon in user space on windows, because windows doesn’t offer the right kind of APIs and hooks from userspace to provide that kind of protection. On Mac OS CrowdStrike falcon runs in userspace already, and on Linux, the kernel interface is provided by eBPF, which acts as a sandbox, preventing certain classes of crash. So it really is true that Microsoft does not provide safe access like other operating systems do.
  - Rinzler89 2y ago
    Does the MacOS Falcon app running in userspace have the exact same monitoring capability like the Windows variant running in kernel space?
  - rawicki 2y ago
    Nothing stops them from writing a minimal kernelspace driver that sends events to the userspace part and evaluates rules there.

noahtallen 2y ago

Well, last point isn’t quite true. Alaska Airlines is primarily iOS. So, iPads scan your boarding pass and are used for printing luggage tags outside security, Flight attendants use iPhones on the planes, etc. And they were of course mostly unaffected by the Cloudstrike outage. Either way, I think it’s a strong point for Apple that antivirus is not required because the iOS security model protects against viruses pretty thoroughly. That’s just not the case for Windows most of the time. Also, do tech companies run antivirus on their linux-based containerized cloud workflows? Not really, the security model doesn’t require it. Points against windows server here

legitster 2y ago
This is incorrect: Alaska Airlines wasn't a Crowdstrike customer. They use SentinalOne, a competitor. They absolutely use Windows desktop environments across their infrastructure.
jeroenhd 2y ago
CrowdStrike is deployed on Linux servers as well, so clearly companies like these do run EDR software on their Linux hosts. Apple pretends they don't need antivirus the same way some Linux advocates will, but viruses exist on both platforms. Very few companies run their digital signage or internal application databases on macOS hosts, mostly because Apple stepped out of that market years ago. Whenever Apple or Linux are deployed at the scale these CrowdStrike desktops are, you can assume similar software is deployed on any platform. This time it was a kernel crash, next time it could be MDM software locking all iPads out of all network access, or null routing all I/O requests in eBPF.
- deleted 2y ago
  [deleted]
- throw0101d 2y ago
  > Apple pretends they don't need antivirus the same way some Linux advocates will, but viruses exist on both platforms. Sure. But when was the last time a company was in the news when they were hit with macOS-, iOS-, or Linux-based ransomware? I'm in IT, but Windows was never my thing/niche. Generally I've viewed two problems with it: 1. when it becomes a monoculture where basically everything in the company runs on it 2. something about its architecture/designs appears (to me, at least) for very easy spreading of malware (does it have some weaker SSH-equivalent that allows easy remote control?) Just ask Maersk about these two points: * https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...