3 ms·

The difference is that Microsoft, as an Operating System Vendor, wanted to get into the Security Software Market, with exclusive access to their operating syste

The difference is that Microsoft, as an Operating System Vendor, wanted to get into the Security Software Market, with exclusive access to their operating systems that none of the existing security software had. Apple does not sell security software so they don't have the same conflict of interest. Microsoft could have responded to the EU request by creating a secure, sandboxed API (like the one Apple has for macOS) and used that both for their own security software and also let third-party software use it. That would have been fair market dealing. But they took the lazy way out and just gave the third party software access to the kernel the same way their own software already used it, so they didn't have to rewrite their own solution.

supriyo-biswas 2y ago
Hooking into NT kernel syscalls were already a thing before the introduction of Defender; Microsoft may have felt that it was easier to continue a similar setup (albeit isolated to device drivers) instead of facing regulatory scrutiny. Apple's responses to the DMA/DSA and Google's Privacy Sandbox have already attracted such scrutiny despite providing alternative APIs. I assume Microsoft Legal could already foresee such a situation arising, and just assumed it was better to leave the system as-is until there was a compelling data point to prove otherwise.
- deleted 2y ago
  [deleted]
pjmlp 2y ago
> Apple has for macOS kexts are still available, yet this misformation keeps being repeated. https://developer.apple.com/documentation/apple-silicon/installing-a-custom-kernel-extension https://developer.apple.com/documentation/apple-silicon/inst...
- nar001 2y ago
  Kexts are being phased out, and are only changeable if you "reduce security" though, so obviously not something that Apple is supporting, it's more "at your own risk" so not really the same as what Microsoft is doing (Supporting people plugging into the kernel itself)
  - pjmlp 2y ago
    True, and as long as they are around, they can be used.
- TillE 2y ago
  Endpoint Security is a user framework, that's the point. You can write a driver in macOS. You have to write a driver for Windows, there is literally no other solution for real-time protection.
  - pjmlp 2y ago
    As long as they are available, they are a possible usage scenario, regardless of what people on HN think companies might be using instead.
zokier 2y ago
I don't think MS particularly wanted to enter security market, they cared far more about making sure that all Windows computers had some level of baseline security solution. The constant virus epidemics were hurting their reputation and they wanted to address that; improving Windows security was pretty major theme for early 00s MS. Indeed I imagine especially then they would have been happy to be completely rid of the AV market instead of entering it as a player. The Vista era Defender product was extremely rudimentary, it's almost certain that the major commercial offerings were doing far more intrusive and complex stuff in kernel. Thus I don't think simply forcing everyone to downgrade to Defenders level would have made anyone happy. Calling MS lazy for not coming up with new novel set of APIs overnight is pretty disingenuous.
- Nullabillity 2y ago
  Microsoft has been selling Forefront (the commercial version of Security Essentials/Defender) since 2007[0], 2 years before Security Essentials was released. [0]: It's hard to track down a specific date since they've been going through a bunch of rebrands, but https://www.csoonline.com/article/545304/cisco-subnet-whatever-happened-to-microsoft-forefront-endpoint-protection.html https://www.csoonline.com/article/545304/cisco-subnet-whatev... seems like the earliest date I can find, with a bunch of other sources from 2009 talking about new updates.

supriyo-biswas 2y ago

Hooking into NT kernel syscalls were already a thing before the introduction of Defender; Microsoft may have felt that it was easier to continue a similar setup (albeit isolated to device drivers) instead of facing regulatory scrutiny. Apple's responses to the DMA/DSA and Google's Privacy Sandbox have already attracted such scrutiny despite providing alternative APIs. I assume Microsoft Legal could already foresee such a situation arising, and just assumed it was better to leave the system as-is until there was a compelling data point to prove otherwise.

deleted 2y ago
[deleted]

pjmlp 2y ago

> Apple has for macOS kexts are still available, yet this misformation keeps being repeated. https://developer.apple.com/documentation/apple-silicon/installing-a-custom-kernel-extension https://developer.apple.com/documentation/apple-silicon/inst...

nar001 2y ago
Kexts are being phased out, and are only changeable if you "reduce security" though, so obviously not something that Apple is supporting, it's more "at your own risk" so not really the same as what Microsoft is doing (Supporting people plugging into the kernel itself)
- pjmlp 2y ago
  True, and as long as they are around, they can be used.
TillE 2y ago
Endpoint Security is a user framework, that's the point. You can write a driver in macOS. You have to write a driver for Windows, there is literally no other solution for real-time protection.
- pjmlp 2y ago
  As long as they are available, they are a possible usage scenario, regardless of what people on HN think companies might be using instead.

zokier 2y ago

I don't think MS particularly wanted to enter security market, they cared far more about making sure that all Windows computers had some level of baseline security solution. The constant virus epidemics were hurting their reputation and they wanted to address that; improving Windows security was pretty major theme for early 00s MS. Indeed I imagine especially then they would have been happy to be completely rid of the AV market instead of entering it as a player. The Vista era Defender product was extremely rudimentary, it's almost certain that the major commercial offerings were doing far more intrusive and complex stuff in kernel. Thus I don't think simply forcing everyone to downgrade to Defenders level would have made anyone happy. Calling MS lazy for not coming up with new novel set of APIs overnight is pretty disingenuous.

Nullabillity 2y ago
Microsoft has been selling Forefront (the commercial version of Security Essentials/Defender) since 2007[0], 2 years before Security Essentials was released. [0]: It's hard to track down a specific date since they've been going through a bunch of rebrands, but https://www.csoonline.com/article/545304/cisco-subnet-whatever-happened-to-microsoft-forefront-endpoint-protection.html https://www.csoonline.com/article/545304/cisco-subnet-whatev... seems like the earliest date I can find, with a bunch of other sources from 2009 talking about new updates.