5 ms·

Microsoft didn't blame the European Commission for the outage (thats a ridiculous headline), they said they can't close off the Kernel due to agreements made wi

Microsoft didn't blame the European Commission for the outage (thats a ridiculous headline), they said they can't close off the Kernel due to agreements made with the European Commission. The original soruce macrumors is quoting is thie WSJ article, see last paragraph: https://archive.is/FLNKH https://archive.is/FLNKH A Microsoft spokesman said it cannot legally wall off its operating system in the same way Apple does because of an understanding it reached with the European Commission following a complaint. In 2009, Microsoft agreed it would give makers of security software the same level of access to Windows that Microsoft gets.

Xylakant 2y ago
They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like product, so the move was easier for them.
- yjftsjthsd-h 2y ago
  > Apple doesn't offer a defender-like product, so the move was easier for them. Isn't that XProtect?
- throwaway4pp24 2y ago
  How do they close the kernel and provide API at the same time?
  - geor9e 2y ago
    Not a kernel-level API - they'd move Defender to an API without kernel-level access. On Mac their API is called Endpoint Security Framework which lets antivirus monitor system calls without giving it kernel-level access. And System Integrity Protection is how they close the kernel. Microsoft would love to do the same, but also want their own Defender to have kernel-level access. The EU says they have to give third-party antivirus the same access they give their own antivirus, for anti-trust reasons. Personally I disagree with the EU here.
isodev 2y ago
There is nothing technically stopping Microsoft from addressing this. Fixing one’s kernel extensions does not violate anticompetitive laws. It does however make for click bait headlines if you as a corp choose to troll everyone affected by CrowdStrike instead of offering mitigations.
notepad0x90 2y ago
I find it unironic how for decades the tech community complained about the apple walled garden and how Microsoft isn't open about kernel internals and how it's hard to get things done with it compared to Linux which is open source. Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux. I think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. While it would be funny to call out the hypocrisy in the tech world, I think the DoJ would indeed sue Microsoft unless it extracted it's own EDR and had it use the same API's it is asking other companies to use. Furthermore, there is something called the anti-malware scanner interface (AMSI) which Falcon and other EDRs indeed use and there is an ETW api that allows them to do additional monitoring as well. But that just isn't enough to counter many real world threats. In effect, the EDR must be like a rootkit to get complete system visibility and be able to stop any and all threats, kernel or userspace. Also, a user space process can prevent booting or freeze systems up.
- Rinzler89 2y ago
  > think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. Which one? Defender isn't a CS competitor.
  - jaderobbins1 2y ago
    There are multiple products called "Defender", I believe "Microsoft Defender for Endpoint" (which is an enterprise product, not the consumer Defender AV) would be considered the same. I _think_ at least, the enterprise software space is confusing as hell :)
  - notepad0x90 2y ago
    the enterprise version, which used to be caused defender advanced threat protection (they keep renaming it) is a direct competitor to Falcon.
- freeopinion 2y ago
  > Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux You are responding to a statement from Microsoft that compares its own behavior to that of Apple. Why do you characterize it as everyone else thinking Microsoft should be more like Apple?

Xylakant 2y ago

They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like product, so the move was easier for them.

yjftsjthsd-h 2y ago
> Apple doesn't offer a defender-like product, so the move was easier for them. Isn't that XProtect?
throwaway4pp24 2y ago
How do they close the kernel and provide API at the same time?
- geor9e 2y ago
  Not a kernel-level API - they'd move Defender to an API without kernel-level access. On Mac their API is called Endpoint Security Framework which lets antivirus monitor system calls without giving it kernel-level access. And System Integrity Protection is how they close the kernel. Microsoft would love to do the same, but also want their own Defender to have kernel-level access. The EU says they have to give third-party antivirus the same access they give their own antivirus, for anti-trust reasons. Personally I disagree with the EU here.

isodev 2y ago

There is nothing technically stopping Microsoft from addressing this. Fixing one’s kernel extensions does not violate anticompetitive laws. It does however make for click bait headlines if you as a corp choose to troll everyone affected by CrowdStrike instead of offering mitigations.

notepad0x90 2y ago

I find it unironic how for decades the tech community complained about the apple walled garden and how Microsoft isn't open about kernel internals and how it's hard to get things done with it compared to Linux which is open source. Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux. I think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. While it would be funny to call out the hypocrisy in the tech world, I think the DoJ would indeed sue Microsoft unless it extracted it's own EDR and had it use the same API's it is asking other companies to use. Furthermore, there is something called the anti-malware scanner interface (AMSI) which Falcon and other EDRs indeed use and there is an ETW api that allows them to do additional monitoring as well. But that just isn't enough to counter many real world threats. In effect, the EDR must be like a rootkit to get complete system visibility and be able to stop any and all threats, kernel or userspace. Also, a user space process can prevent booting or freeze systems up.

Rinzler89 2y ago
> think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. Which one? Defender isn't a CS competitor.
- jaderobbins1 2y ago
  There are multiple products called "Defender", I believe "Microsoft Defender for Endpoint" (which is an enterprise product, not the consumer Defender AV) would be considered the same. I _think_ at least, the enterprise software space is confusing as hell :)
- notepad0x90 2y ago
  the enterprise version, which used to be caused defender advanced threat protection (they keep renaming it) is a direct competitor to Falcon.
freeopinion 2y ago
> Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux You are responding to a statement from Microsoft that compares its own behavior to that of Apple. Why do you characterize it as everyone else thinking Microsoft should be more like Apple?