12 ms·

>Nothing is stopping Microsoft from offering “safe” access to both themselves and third parties. They are offering "safe" access, it's called userspace.

isodev 2y ago
Then the blame can safely go to the vendor who opted not to take advantage. If anything, the Crowdstrike incident highlights the lack of diversity in the OS/security space. Everyone using the same stack makes everyone vulnerable to the same bugs.
MobiusHorizons 2y ago
You can’t write programs like CrowdStrike falcon in user space on windows, because windows doesn’t offer the right kind of APIs and hooks from userspace to provide that kind of protection. On Mac OS CrowdStrike falcon runs in userspace already, and on Linux, the kernel interface is provided by eBPF, which acts as a sandbox, preventing certain classes of crash. So it really is true that Microsoft does not provide safe access like other operating systems do.
- Rinzler89 2y ago
  Does the MacOS Falcon app running in userspace have the exact same monitoring capability like the Windows variant running in kernel space?
- rawicki 2y ago
  Nothing stops them from writing a minimal kernelspace driver that sends events to the userspace part and evaluates rules there.
freeopinion 2y ago
To be clear, they have to offer third parties the same access they enjoy themselves. If they provide a spell-checker that requires kernel implementation, they have to give all competing spell-checkers the same access. Obviously, it seems ludicrous to implement spell-checking in the kernel. Imagine if MS imposed the discipline upon themselves to provide enough API that their own security products didn't reach for the kernel crutch. Linux is different because it is open source. If a vendor wants to reach into the kernel, it's completely possible. If they want to provide patches to the kernel that allow their or any other product to do what it needs outside the kernel, they can. But even if the kernel provided all the necessary APIs, vendors could ignore those and insist on being inside the kernel. It is up to the user to use wisdom about what they install. And there is no unfair advantage to the OS vendor competing with third-party apps. It is silly to blame regulators instead of the app vendor in this case. I'm not sure why MS feels the need to deflect blame. I know that some are eager to point the finger at MS, but MS shouldn't be so defensive. It makes it look like they think there is some merit to those arguments that has to be deflected.
- legitster 2y ago
  > I'm not sure why MS feels the need to deflect blame. Everyone is editorializing. Microsoft never actually blamed the EU. They just were explaining why their kernel was open to third parties in the first place.
  - Rinzler89 2y ago
    Their kernel was open to SW devs since the very beginning, it's one of the reason that helped Windows grew in popularity especially as a video game platform. Early 3d games needed direct kernel access to extract maximum performance from the HW, but then MS built Direct3D as a wrapper for that direct HW access so games couldn't crash your whole system.

isodev 2y ago

Then the blame can safely go to the vendor who opted not to take advantage. If anything, the Crowdstrike incident highlights the lack of diversity in the OS/security space. Everyone using the same stack makes everyone vulnerable to the same bugs.

MobiusHorizons 2y ago

You can’t write programs like CrowdStrike falcon in user space on windows, because windows doesn’t offer the right kind of APIs and hooks from userspace to provide that kind of protection. On Mac OS CrowdStrike falcon runs in userspace already, and on Linux, the kernel interface is provided by eBPF, which acts as a sandbox, preventing certain classes of crash. So it really is true that Microsoft does not provide safe access like other operating systems do.

Rinzler89 2y ago
Does the MacOS Falcon app running in userspace have the exact same monitoring capability like the Windows variant running in kernel space?
rawicki 2y ago
Nothing stops them from writing a minimal kernelspace driver that sends events to the userspace part and evaluates rules there.

freeopinion 2y ago

To be clear, they have to offer third parties the same access they enjoy themselves. If they provide a spell-checker that requires kernel implementation, they have to give all competing spell-checkers the same access. Obviously, it seems ludicrous to implement spell-checking in the kernel. Imagine if MS imposed the discipline upon themselves to provide enough API that their own security products didn't reach for the kernel crutch. Linux is different because it is open source. If a vendor wants to reach into the kernel, it's completely possible. If they want to provide patches to the kernel that allow their or any other product to do what it needs outside the kernel, they can. But even if the kernel provided all the necessary APIs, vendors could ignore those and insist on being inside the kernel. It is up to the user to use wisdom about what they install. And there is no unfair advantage to the OS vendor competing with third-party apps. It is silly to blame regulators instead of the app vendor in this case. I'm not sure why MS feels the need to deflect blame. I know that some are eager to point the finger at MS, but MS shouldn't be so defensive. It makes it look like they think there is some merit to those arguments that has to be deflected.

legitster 2y ago
> I'm not sure why MS feels the need to deflect blame. Everyone is editorializing. Microsoft never actually blamed the EU. They just were explaining why their kernel was open to third parties in the first place.
- Rinzler89 2y ago
  Their kernel was open to SW devs since the very beginning, it's one of the reason that helped Windows grew in popularity especially as a video game platform. Early 3d games needed direct kernel access to extract maximum performance from the HW, but then MS built Direct3D as a wrapper for that direct HW access so games couldn't crash your whole system.