4 ms·
They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like
by Xylakant 2y ago
They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like product, so the move was easier for them.
- yjftsjthsd-h 2y ago> Apple doesn't offer a defender-like product, so the move was easier for them. Isn't that XProtect?
- throwaway4pp24 2y agoHow do they close the kernel and provide API at the same time?
- geor9e 2y agoNot a kernel-level API - they'd move Defender to an API without kernel-level access. On Mac their API is called Endpoint Security Framework which lets antivirus monitor system calls without giving it kernel-level access. And System Integrity Protection is how they close the kernel. Microsoft would love to do the same, but also want their own Defender to have kernel-level access. The EU says they have to give third-party antivirus the same access they give their own antivirus, for anti-trust reasons. Personally I disagree with the EU here.