4 ms·

I find it interesting how history can sometimes determine our legal and technical frameworks. The Crowdstrike issue we see is essentially a foreseeable conseque

I find it interesting how history can sometimes determine our legal and technical frameworks. The Crowdstrike issue we see is essentially a foreseeable consequence of this decision. As another comment pointed out, Apple don't provide the same level of access for app developers for iPhones, yet don't have the same scrutiny. I'd wager this is partially because antivirus vendors for iPhone never existed, which weakens their standing in a legal sense. Unlike browser and antivirus vendors for Windows, you'd be demanding the courts create a new market for you, as opposed to preventing a monopoly from removing one. I don't have an answer, or even a specific opinion, to this. Just making an observation.

kalleboo 2y ago
The difference is that Microsoft, as an Operating System Vendor, wanted to get into the Security Software Market, with exclusive access to their operating systems that none of the existing security software had. Apple does not sell security software so they don't have the same conflict of interest. Microsoft could have responded to the EU request by creating a secure, sandboxed API (like the one Apple has for macOS) and used that both for their own security software and also let third-party software use it. That would have been fair market dealing. But they took the lazy way out and just gave the third party software access to the kernel the same way their own software already used it, so they didn't have to rewrite their own solution.
- supriyo-biswas 2y ago
  Hooking into NT kernel syscalls were already a thing before the introduction of Defender; Microsoft may have felt that it was easier to continue a similar setup (albeit isolated to device drivers) instead of facing regulatory scrutiny. Apple's responses to the DMA/DSA and Google's Privacy Sandbox have already attracted such scrutiny despite providing alternative APIs. I assume Microsoft Legal could already foresee such a situation arising, and just assumed it was better to leave the system as-is until there was a compelling data point to prove otherwise.
  - deleted 2y ago
    [deleted]
- pjmlp 2y ago
  > Apple has for macOS kexts are still available, yet this misformation keeps being repeated. https://developer.apple.com/documentation/apple-silicon/installing-a-custom-kernel-extension https://developer.apple.com/documentation/apple-silicon/inst...
  - nar001 2y ago
    Kexts are being phased out, and are only changeable if you "reduce security" though, so obviously not something that Apple is supporting, it's more "at your own risk" so not really the same as what Microsoft is doing (Supporting people plugging into the kernel itself)
    - pjmlp 2y ago
      True, and as long as they are around, they can be used.
  - TillE 2y ago
    Endpoint Security is a user framework, that's the point. You can write a driver in macOS. You have to write a driver for Windows, there is literally no other solution for real-time protection.
    - pjmlp 2y ago
      As long as they are available, they are a possible usage scenario, regardless of what people on HN think companies might be using instead.
- zokier 2y ago
  I don't think MS particularly wanted to enter security market, they cared far more about making sure that all Windows computers had some level of baseline security solution. The constant virus epidemics were hurting their reputation and they wanted to address that; improving Windows security was pretty major theme for early 00s MS. Indeed I imagine especially then they would have been happy to be completely rid of the AV market instead of entering it as a player. The Vista era Defender product was extremely rudimentary, it's almost certain that the major commercial offerings were doing far more intrusive and complex stuff in kernel. Thus I don't think simply forcing everyone to downgrade to Defenders level would have made anyone happy. Calling MS lazy for not coming up with new novel set of APIs overnight is pretty disingenuous.
  - Nullabillity 2y ago
    Microsoft has been selling Forefront (the commercial version of Security Essentials/Defender) since 2007[0], 2 years before Security Essentials was released. [0]: It's hard to track down a specific date since they've been going through a bunch of rebrands, but https://www.csoonline.com/article/545304/cisco-subnet-whatever-happened-to-microsoft-forefront-endpoint-protection.html https://www.csoonline.com/article/545304/cisco-subnet-whatev... seems like the earliest date I can find, with a bunch of other sources from 2009 talking about new updates.
paulmd 2y ago
> As another comment pointed out, Apple don't provide the same level of access for app developers for iPhones, yet don't have the same scrutiny. I'd wager this is partially because antivirus vendors for iPhone never existed, which weakens their standing in a legal sense. I think the Intel thing is another interesting case of this. Once those overclocking controls exist, it's pretty hard to actively take them away from people (and partners) without looking like a jerk in the process, even if they are now dangerous in a way they weren't previously. NVIDIA got a ton of heat for this back when Turing launched. You heard all the excuses: "electromigration doesn't happen on modern processors, unless it's like 4.7 GHz sandy bridge" etc. https://x.com/Sebasti66855537/status/1816955349636710535 https://x.com/Sebasti66855537/status/1816955349636710535 You almost need one of these kinds of incidents to get people to take a step back and realize what's at stake. Because people will keep living in 2007 forever - you see this with gpu pricing and economics too. And in turn this does create a perverse incentive to just not offer these things in the first place, I think that’s correct. That’s the way we’ve written the laws, it’s worse to take it away than to never offer it. And there’s valid logic supporting that too - now other people’s livelihoods depend on your indulgence, and they get the business equivalent of tenant rights. (although there are instances where it has been successfully rolled back, notably the third-party chipset market no longer exists, intel locked that down and AMD immediately followed.)
- paulmd 2y ago
  contemporary discussion (as they say: "thanks, macro-expanded:") https://old.reddit.com/r/nvidia/comments/9ge8t0/rtx_2080_voltage_limit_boost_40_oc_interview_w/ https://old.reddit.com/r/nvidia/comments/9ge8t0/rtx_2080_vol... https://old.reddit.com/r/hardware/comments/9gedcf/gamers_nexus_interview_w_tom_petersen_rtx_2080/ https://old.reddit.com/r/hardware/comments/9gedcf/gamers_nex... https://old.reddit.com/r/pcmasterrace/comments/9gedbj/rtx_2080_voltage_limit_boost_40_oc_interview_w/ https://old.reddit.com/r/pcmasterrace/comments/9gedbj/rtx_20...

kalleboo 2y ago

The difference is that Microsoft, as an Operating System Vendor, wanted to get into the Security Software Market, with exclusive access to their operating systems that none of the existing security software had. Apple does not sell security software so they don't have the same conflict of interest. Microsoft could have responded to the EU request by creating a secure, sandboxed API (like the one Apple has for macOS) and used that both for their own security software and also let third-party software use it. That would have been fair market dealing. But they took the lazy way out and just gave the third party software access to the kernel the same way their own software already used it, so they didn't have to rewrite their own solution.

supriyo-biswas 2y ago
Hooking into NT kernel syscalls were already a thing before the introduction of Defender; Microsoft may have felt that it was easier to continue a similar setup (albeit isolated to device drivers) instead of facing regulatory scrutiny. Apple's responses to the DMA/DSA and Google's Privacy Sandbox have already attracted such scrutiny despite providing alternative APIs. I assume Microsoft Legal could already foresee such a situation arising, and just assumed it was better to leave the system as-is until there was a compelling data point to prove otherwise.
- deleted 2y ago
  [deleted]
pjmlp 2y ago
> Apple has for macOS kexts are still available, yet this misformation keeps being repeated. https://developer.apple.com/documentation/apple-silicon/installing-a-custom-kernel-extension https://developer.apple.com/documentation/apple-silicon/inst...
- nar001 2y ago
  Kexts are being phased out, and are only changeable if you "reduce security" though, so obviously not something that Apple is supporting, it's more "at your own risk" so not really the same as what Microsoft is doing (Supporting people plugging into the kernel itself)
  - pjmlp 2y ago
    True, and as long as they are around, they can be used.
- TillE 2y ago
  Endpoint Security is a user framework, that's the point. You can write a driver in macOS. You have to write a driver for Windows, there is literally no other solution for real-time protection.
  - pjmlp 2y ago
    As long as they are available, they are a possible usage scenario, regardless of what people on HN think companies might be using instead.
zokier 2y ago
I don't think MS particularly wanted to enter security market, they cared far more about making sure that all Windows computers had some level of baseline security solution. The constant virus epidemics were hurting their reputation and they wanted to address that; improving Windows security was pretty major theme for early 00s MS. Indeed I imagine especially then they would have been happy to be completely rid of the AV market instead of entering it as a player. The Vista era Defender product was extremely rudimentary, it's almost certain that the major commercial offerings were doing far more intrusive and complex stuff in kernel. Thus I don't think simply forcing everyone to downgrade to Defenders level would have made anyone happy. Calling MS lazy for not coming up with new novel set of APIs overnight is pretty disingenuous.
- Nullabillity 2y ago
  Microsoft has been selling Forefront (the commercial version of Security Essentials/Defender) since 2007[0], 2 years before Security Essentials was released. [0]: It's hard to track down a specific date since they've been going through a bunch of rebrands, but https://www.csoonline.com/article/545304/cisco-subnet-whatever-happened-to-microsoft-forefront-endpoint-protection.html https://www.csoonline.com/article/545304/cisco-subnet-whatev... seems like the earliest date I can find, with a bunch of other sources from 2009 talking about new updates.

paulmd 2y ago

> As another comment pointed out, Apple don't provide the same level of access for app developers for iPhones, yet don't have the same scrutiny. I'd wager this is partially because antivirus vendors for iPhone never existed, which weakens their standing in a legal sense. I think the Intel thing is another interesting case of this. Once those overclocking controls exist, it's pretty hard to actively take them away from people (and partners) without looking like a jerk in the process, even if they are now dangerous in a way they weren't previously. NVIDIA got a ton of heat for this back when Turing launched. You heard all the excuses: "electromigration doesn't happen on modern processors, unless it's like 4.7 GHz sandy bridge" etc. https://x.com/Sebasti66855537/status/1816955349636710535 https://x.com/Sebasti66855537/status/1816955349636710535 You almost need one of these kinds of incidents to get people to take a step back and realize what's at stake. Because people will keep living in 2007 forever - you see this with gpu pricing and economics too. And in turn this does create a perverse incentive to just not offer these things in the first place, I think that’s correct. That’s the way we’ve written the laws, it’s worse to take it away than to never offer it. And there’s valid logic supporting that too - now other people’s livelihoods depend on your indulgence, and they get the business equivalent of tenant rights. (although there are instances where it has been successfully rolled back, notably the third-party chipset market no longer exists, intel locked that down and AMD immediately followed.)

paulmd 2y ago
contemporary discussion (as they say: "thanks, macro-expanded:") https://old.reddit.com/r/nvidia/comments/9ge8t0/rtx_2080_voltage_limit_boost_40_oc_interview_w/ https://old.reddit.com/r/nvidia/comments/9ge8t0/rtx_2080_vol... https://old.reddit.com/r/hardware/comments/9gedcf/gamers_nexus_interview_w_tom_petersen_rtx_2080/ https://old.reddit.com/r/hardware/comments/9gedcf/gamers_nex... https://old.reddit.com/r/pcmasterrace/comments/9gedbj/rtx_2080_voltage_limit_boost_40_oc_interview_w/ https://old.reddit.com/r/pcmasterrace/comments/9gedbj/rtx_20...