3 ms·

> You can't just let people do anything from userland, the performance would tank Isn't the point of userland that you can (try to) do anything from there? It

by ahepp 2y ago

> You can't just let people do anything from userland, the performance would tank Isn't the point of userland that you can (try to) do anything from there? It seems like MacOS and Linux provide substantially safer alternatives that are still performant? > As for restricting kernelland, EU competition regulators would not be happy I keep seeing people say this. Is there a basis for that assertion, or is that mere speculation? Again, hasn't MacOS already deprecated kexts?

intern4tional 2y ago
There is basis for that assertion. Via Google: https://www.techtarget.com/searchsecurity/news/450420491/Microsoft-accused-of-blocking-independent-antivirus-competition https://www.techtarget.com/searchsecurity/news/450420491/Mic... (Also via myself, as I was at MS when we wanted to make this change and the EU said no.)
- philistine 2y ago
  Well Microsoft did not publicly commit to using the same APIs, and no privileged access, for its own antivirus products. That's why the EU said no way; not because kernel access was revoked.
  - guiriduro 2y ago
    Yes, but then of course Microsoft is being obligated to open part of kernelspace to competitors, which is arguably "OK" from a competitive regulation perspective, but that then places a special burden on competitors to maintain code hygiene given the potential for crashes. It makes CrowdStrike's negligence all the more unacceptable.
    - ahepp 2y ago
      I believe what philistine is suggesting is that Microsoft could have implemented their own security offering using a safer alternative like eBPF, and then opened that interface to competitors as well. I think that would have been a proactive approach. That said, I'm not entirely convinced that the EU was right to place the restriction in the first place.
- ahepp 2y ago
  The article you shared says that Kaspersky filed a complaint, but I didn't see a clear statement there about what the outcome was. I do now see other reputable sources reporting that an agreement was reached in 2009 where Microsoft promised to allow vendors the same access to the kernel its security software had [0]. I think a proactive approach might have been for Microsoft to provide safer interfaces with the kernel, and then use those in its own security offerings. That said, it does sound like EU competition regulation was a contributing factor here, and I think the EU is wrong on this one and that an OS vendor should not be required to provide unrestricted kernel access to allow security software vendors to compete. Mostly unrelated, it seems somewhat interesting that this was Kaspersky insisting on kernel access... The US government seems convinced they are compromised. [0]: https://www.ft.com/content/60dde560-194a-40d1-8c98-1d96d6d019a0 https://www.ft.com/content/60dde560-194a-40d1-8c98-1d96d6d01...
112233 2y ago
What are the Linux alternatives you are talking about?
pjmlp 2y ago
MacOS still keeps the kexts support around, even if the long term roadmap is to move everything into userspace.

by ahepp 2y ago

intern4tional 2y ago

There is basis for that assertion. Via Google: https://www.techtarget.com/searchsecurity/news/450420491/Microsoft-accused-of-blocking-independent-antivirus-competition https://www.techtarget.com/searchsecurity/news/450420491/Mic... (Also via myself, as I was at MS when we wanted to make this change and the EU said no.)

philistine 2y ago
Well Microsoft did not publicly commit to using the same APIs, and no privileged access, for its own antivirus products. That's why the EU said no way; not because kernel access was revoked.
- guiriduro 2y ago
  Yes, but then of course Microsoft is being obligated to open part of kernelspace to competitors, which is arguably "OK" from a competitive regulation perspective, but that then places a special burden on competitors to maintain code hygiene given the potential for crashes. It makes CrowdStrike's negligence all the more unacceptable.
  - ahepp 2y ago
    I believe what philistine is suggesting is that Microsoft could have implemented their own security offering using a safer alternative like eBPF, and then opened that interface to competitors as well. I think that would have been a proactive approach. That said, I'm not entirely convinced that the EU was right to place the restriction in the first place.
ahepp 2y ago
The article you shared says that Kaspersky filed a complaint, but I didn't see a clear statement there about what the outcome was. I do now see other reputable sources reporting that an agreement was reached in 2009 where Microsoft promised to allow vendors the same access to the kernel its security software had [0]. I think a proactive approach might have been for Microsoft to provide safer interfaces with the kernel, and then use those in its own security offerings. That said, it does sound like EU competition regulation was a contributing factor here, and I think the EU is wrong on this one and that an OS vendor should not be required to provide unrestricted kernel access to allow security software vendors to compete. Mostly unrelated, it seems somewhat interesting that this was Kaspersky insisting on kernel access... The US government seems convinced they are compromised. [0]: https://www.ft.com/content/60dde560-194a-40d1-8c98-1d96d6d019a0 https://www.ft.com/content/60dde560-194a-40d1-8c98-1d96d6d01...

112233 2y ago

What are the Linux alternatives you are talking about?

pjmlp 2y ago

MacOS still keeps the kexts support around, even if the long term roadmap is to move everything into userspace.