3 ms·

Apple provides the kernel implementation and the API. They don't offer a real competing alternative for the user mode side of the equation. They leave that to t

Apple provides the kernel implementation and the API. They don't offer a real competing alternative for the user mode side of the equation. They leave that to the ecosystem. It's a fair trade-off. They can focus on keeping the kernel secure and stable, and the ecosystem can work on all the different ways you can implement anti-malware policy and integrate it into a larger system of endpoint security. MS offers a full competitive product, and they allowed that product to use features and capabilities that wouldn't be available to others. At their scale, you can't do that without drawing scrutiny from regulators. They could have at least kicked their own product out to userland, or just stopped offering one and focused on kernel stability the way Apple has. Since this is all spitballing, perhaps they even suggested that the EU, and the EU said "no, it must be kernel access" and capitulated because this served their own interests while also letting them blame the EU for the lack of kernel stability.

jojobas 2y ago
There's XProtectDetection, it downloads signatures and checks executables. I'd say it's in the ballpark.
- numbsafari 2y ago
  If you are in the market to sell EDR tools and you can’t find a way to provide value beyond what XProtect offers, you probably shouldn’t be in the market.
  - jojobas 2y ago
    That's up to the market to decide, isn't it?
    - numbsafari 2y ago
      It is. The difference between XProtect and Defender, is that XProtect utilizes the same kernel interface that Apple provides to other EDR solutions, whereas Microsoft was / is only willing to implement Defender using an in-kernel solution. As a result, it would be anti-competitive for Microsoft to deny that level of access to third party EDR solutions. I do wish that the EU would offer a "grace period" for "platform owners" or "gatekeepers" that would allow them to use non-public APIs for their first-party solutions while they stabilize and work out the public API offering. I think there should be some requirements for them to "earn" that grace period, such as allowing interested third-parties to get early access and provide feedback on those APIs. Regardless, it takes time to stabilize those APIs, and the current EU approach of requiring all new APIs to be fully public on day one just isn't workable.

jojobas 2y ago

There's XProtectDetection, it downloads signatures and checks executables. I'd say it's in the ballpark.

numbsafari 2y ago
If you are in the market to sell EDR tools and you can’t find a way to provide value beyond what XProtect offers, you probably shouldn’t be in the market.
- jojobas 2y ago
  That's up to the market to decide, isn't it?
  - numbsafari 2y ago
    It is. The difference between XProtect and Defender, is that XProtect utilizes the same kernel interface that Apple provides to other EDR solutions, whereas Microsoft was / is only willing to implement Defender using an in-kernel solution. As a result, it would be anti-competitive for Microsoft to deny that level of access to third party EDR solutions. I do wish that the EU would offer a "grace period" for "platform owners" or "gatekeepers" that would allow them to use non-public APIs for their first-party solutions while they stabilize and work out the public API offering. I think there should be some requirements for them to "earn" that grace period, such as allowing interested third-parties to get early access and provide feedback on those APIs. Regardless, it takes time to stabilize those APIs, and the current EU approach of requiring all new APIs to be fully public on day one just isn't workable.