3 ms·
I find it unironic how for decades the tech community complained about the apple walled garden and how Microsoft isn't open about kernel internals and how it's
by notepad0x90 2y ago
I find it unironic how for decades the tech community complained about the apple walled garden and how Microsoft isn't open about kernel internals and how it's hard to get things done with it compared to Linux which is open source. Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux.
I think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. While it would be funny to call out the hypocrisy in the tech world, I think the DoJ would indeed sue Microsoft unless it extracted it's own EDR and had it use the same API's it is asking other companies to use. Furthermore, there is something called the anti-malware scanner interface (AMSI) which Falcon and other EDRs indeed use and there is an ETW api that allows them to do additional monitoring as well. But that just isn't enough to counter many real world threats. In effect, the EDR must be like a rootkit to get complete system visibility and be able to stop any and all threats, kernel or userspace. Also, a user space process can prevent booting or freeze systems up.
- Rinzler89 2y ago> think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. Which one? Defender isn't a CS competitor.
- jaderobbins1 2y agoThere are multiple products called "Defender", I believe "Microsoft Defender for Endpoint" (which is an enterprise product, not the consumer Defender AV) would be considered the same. I _think_ at least, the enterprise software space is confusing as hell :)
- notepad0x90 2y agothe enterprise version, which used to be caused defender advanced threat protection (they keep renaming it) is a direct competitor to Falcon.
- freeopinion 2y ago> Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux You are responding to a statement from Microsoft that compares its own behavior to that of Apple. Why do you characterize it as everyone else thinking Microsoft should be more like Apple?
- notepad0x90 2y agoBecause Microsoft is responding to "everyone" who are asking it why it is allowing EDR makers to write drivers. Win10+ only load signed drivers, so every driver is approved by Microsoft. I'm criticizing the people and journalists that are asking this question. I'm sure congress will grill Microsoft's CEO as well and ask this same question again.