5 ms·
> I can't help but think about the fact that Apple kicked security vendors out of kernel-mode a ways back, and that if Windows had done similarly, an issue like
by Rinzler89 2y ago
> I can't help but think about the fact that Apple kicked security vendors out of kernel-mode a ways back, and that if Windows had done similarly, an issue like this probably wouldn't have been possible
Like others already said, Microsoft already tried to do that with PatchGuard in 2006 with the launch of Windows Vista and the likes of Symantec and McAfee complained to the EU about this would harm the sales of their products, so the EU told Microsoft to not do it in 2009[1].
Apple has the luxury of a small market share on the desktop PC space to not attract the attention of the regulators, plus a user base that's used to Apple constantly rewriting the OS, deprecating APIs, switching CPU architectures, etc. without giving a fuck about breaking backwards compatibility or cutting off developers access to OS features their products use and getting away with it, luxuries that Microsoft doesn't have.
IMHO, sticking with Window's default security and not using third party anit-malware has made Windows vastly more secure and rulabile than it was in the days when you'd be looking on installing the likes of Symantec or McAfee for your "protection" which ended up acting like malware after a while throwing dark patterns at you to milk more subsection fees, so as much as it hurts their sales, it's important for the regulators to understand that security is far more important than the regulations they put on Windows for Internet Explorer and Media Player and just like Apple's apps-store, it's sometimes better to let the original product maker handle security and not leave the product open at all points just so some of these bandits can make a living selling security for it. It's like foxes complaining to regulators how chicken wire is a threat to their existence.
[1] https://stratechery.com/2024/crashes-and-competition/ https://stratechery.com/2024/crashes-and-competition/
- rrix2 2y ago[flagged]
- Rinzler89 2y agoThat's an interesting theory. Do you have any sources for this? Because so far there has been no technical arguments to support your PoV.
- spott 2y agoWasn’t the whole regulatory argument that Microsoft was using kernel mode in their security software, while trying to relegate third party security software to user land? In that case, regulators stepped in and made Microsoft open up kernel mode to level the playing field.
- jojobas 2y agoSo how's that different from Apple's security features in the kernel?
- spott 2y agoI don’t understand this world well enough to describe it well, but my understanding is that the security features in the kernel are different in purpose from the security features of something like an antivirus.
- jojobas 2y agoThere's XProtectDetection, it downloads signatures and checks executables. I'd say it's in the ballpark.
- numbsafari 2y agoApple provides the kernel implementation and the API. They don't offer a real competing alternative for the user mode side of the equation. They leave that to the ecosystem. It's a fair trade-off. They can focus on keeping the kernel secure and stable, and the ecosystem can work on all the different ways you can implement anti-malware policy and integrate it into a larger system of endpoint security. MS offers a full competitive product, and they allowed that product to use features and capabilities that wouldn't be available to others. At their scale, you can't do that without drawing scrutiny from regulators. They could have at least kicked their own product out to userland, or just stopped offering one and focused on kernel stability the way Apple has. Since this is all spitballing, perhaps they even suggested that the EU, and the EU said "no, it must be kernel access" and capitulated because this served their own interests while also letting them blame the EU for the lack of kernel stability.
- foota 2y agoI don't see the malicious part of the compliance here. Maybe lazy compliance?
- feyman_r 2y agoLots of allegations here. Can you share examples with sources of other operating systems following practices which you mention here? I presume Mac allows the same level of access for CRWD through user mode access only and that’s the only way they do it too. Same goes for Linux. I genuinely want to understand this - how everyone else got it right and this entity got it wrong.
- mschuster91 2y ago> Can you share examples with sources of other operating systems following practices which you mention here? Well, both dominant mobile operating systems already enforce a very strict security model. Too strict if you ask me because on neither you as the person actually owning the damn thing can become root without anything in the system throwing wrenches in your way, but hey. The result is, most people don't even need a virus scanner, and the blast radius of a bug in an application is usually limited to whatever data that application can access. It's been ages since I heard about the last major mobile OS malware in the wild that didn't involve one of the world's secret services or their civilian suppliers - and that way, one can argue, all the security theatre actually works: it's driven the price of successful attacks so high that only nation states can afford it, and even these have to restrain themselves to only use these exploits against targets of extremely high value.
- feyman_r 2y agoThe reason mobile OS don’t have such a problem is because of the ‘walled-garden’ for App Store. Essentially, every binary being run on all Apple and likely most Android has been ‘blessed’ by the manufacturer App Store. Is it possible to rootkit phones? Yes; does a typical user do it - heck no.
- dagmx 2y agoThe app store does some pre-checks, yes. But it can’t catch all the security vulnerabilities that might be unknown. It’s only a small piece of the pie. Largely it exists to make sure apps work, don’t have malicious UX patterns and don’t use private APIs. iOS (and to a lesser degree, macOS) use notarization to be able to pull apps found of being risky as needed. Additionally they implement much stricter levels of sandboxing so that even if something slips by all detection, it’s heavily limited in what it can do without a users explicit permission or a catastrophic vulnerability.
- nopcode 2y agoMicrosoft sells endpoint security products and it would be unfair if third party solutions couldn't leverage the same APIs, it makes a lot of sense that a regulator steps in. I'm not aware of Apple selling security products or competing with third party security products.
- self_awareness 2y agoI don't know. Would it be unfair? Cars are sold with integrated radios and players. But at the same time there were independent companies selling car radios back in times when they were exchangable. Now external players are gone, everything is integrated, and the market for custom car players is dead. And nobody cares! One could say that car manufacturers don't offer the same API for car player companies. I think that Microsoft is the king of their system, and can do whatever they please. If that doesn't sound practical or trustworthy for a company, then maybe the company just shouldn't release the product on their system. Use a different platform. Because if you release a product on their platform, then you're saying that you're okay with their rules.
- Corrado 2y agoI work in a heavily regulated industry (healthcare) and I can tell you that if anti-virus products weren't required to pass audits we wouldn't be using them. I'm not super familiar with Windows built-in security anymore but macOS (our platform of choice) is pretty secure without any additional products. In fact, I'm pretty sure that adding A/V "solutions" makes us more vulnerable, not less.
- aiisjustanif 2y agoCrowdstrike is not an anti-virus solution though.