3 ms·

Just Devils advocate, but, If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited.

Just Devils advocate, but, If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited. I’m not sure it’s gonna hamper things legally too much to let MS, and everyone else for that matter, Apple, Linux, Android, whoever, erect defensive walls around their own kernels. This is just security 101 for devices these days, and it doesn’t stop anyone else from participating in the windows, android, apple ecosystem.

lazide 2y ago
The issue is Defender and equivalents. Those would have access of course, and hence have an extreme competitive advantage relative to other products. Even more than they do now. Kiss any non-Microsoft antivirus or security software goodbye.
- Rinzler89 2y ago
  >The issue is Defender and equivalents. Not just that, but that would break backwards compatibility with a lot of niche but important apps, since Windows was very popular with use cases where companies have developed kernel space drivers for their Windows products. Yanking that away for security with break backwards compatibility.
  - lazide 2y ago
    Are you talking hardware drivers or something else?
- whimsicalism 2y ago
  I think userspace AV would work fine for 99%+ of usecases, not some extreme competitive advantage.
  - lazide 2y ago
    Not even close - real time memory scanning? Suspicious memory access detection? Suspicious file access detection? Suspicious network traffic? Suspicious kernel calls? Introspection on running program code? It’s already a major performance impact, throwing it into user space would kill those products entirely.
    - whimsicalism 2y ago
      what mac AVs support this?
      - lazide 2y ago
        Mac’s are a tiny segment of the business market, and hence get almost none of the attention from attacks.
CRConrad 2y ago
> Just Devils advocate, but, But misguided, as usual when someone defends Microsoft. > If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited They are allowed to protect “their kernel”. (And / or everything else, which AFAIK is what anti-virus software is supposed to do.) It's just that they're only allowed to do it the same way they allow everyone else to do the same thing. So, being the lazy arseholes they are, they let everyone else into the kernel like they do it, in stead of doing what they should have done: Do it from userspace like anti-virus software used to work, or build a secure API that lets software protect the kernel without being able to take it down / prevent it from booting up — and use that API themselves, in their own separate anti-virus product. Then that product would have been on an even footing in the marketplace with its competitors, which is what the agreement with the EU sought to achieve. But Microsoft cheaped out and took the easier, cheaper — and riskier! — route. This debacle is as much on them as on Crowdstrike.

lazide 2y ago

The issue is Defender and equivalents. Those would have access of course, and hence have an extreme competitive advantage relative to other products. Even more than they do now. Kiss any non-Microsoft antivirus or security software goodbye.

Rinzler89 2y ago
>The issue is Defender and equivalents. Not just that, but that would break backwards compatibility with a lot of niche but important apps, since Windows was very popular with use cases where companies have developed kernel space drivers for their Windows products. Yanking that away for security with break backwards compatibility.
- lazide 2y ago
  Are you talking hardware drivers or something else?
whimsicalism 2y ago
I think userspace AV would work fine for 99%+ of usecases, not some extreme competitive advantage.
- lazide 2y ago
  Not even close - real time memory scanning? Suspicious memory access detection? Suspicious file access detection? Suspicious network traffic? Suspicious kernel calls? Introspection on running program code? It’s already a major performance impact, throwing it into user space would kill those products entirely.
  - whimsicalism 2y ago
    what mac AVs support this?
    - lazide 2y ago
      Mac’s are a tiny segment of the business market, and hence get almost none of the attention from attacks.

CRConrad 2y ago

> Just Devils advocate, but, But misguided, as usual when someone defends Microsoft. > If MS is really not allowed to protect their kernel, that part of whatever EU understanding they have should probably be revisited They are allowed to protect “their kernel”. (And / or everything else, which AFAIK is what anti-virus software is supposed to do.) It's just that they're only allowed to do it the same way they allow everyone else to do the same thing. So, being the lazy arseholes they are, they let everyone else into the kernel like they do it, in stead of doing what they should have done: Do it from userspace like anti-virus software used to work, or build a secure API that lets software protect the kernel without being able to take it down / prevent it from booting up — and use that API themselves, in their own separate anti-virus product. Then that product would have been on an even footing in the marketplace with its competitors, which is what the agreement with the EU sought to achieve. But Microsoft cheaped out and took the easier, cheaper — and riskier! — route. This debacle is as much on them as on Crowdstrike.