2 ms·
Key quote from my link: > Third party vendors are forced into writing unsafe kernel drivers because Microsoft does not provide sufficient user mode APIs. AFAI
by fsflover 2y ago
Key quote from my link:
> Third party vendors are forced into writing unsafe kernel drivers because Microsoft does not provide sufficient user mode APIs.
AFAIK it's different on Linux, and the reliability is higher. Is this not the case?
- vel0city 2y agohttps://forums.rockylinux.org/t/crowdstrike-freezing-rockylinux-after-9-4-upgrade/14041 https://forums.rockylinux.org/t/crowdstrike-freezing-rockyli... https://access.redhat.com/solutions/7068083 https://access.redhat.com/solutions/7068083 https://lists.debian.org/debian-kernel/2024/04/msg00202.html https://lists.debian.org/debian-kernel/2024/04/msg00202.html You can install buggy kernel modules in Linux as well. I can't even count how many times an apt upgrade/yum update made my system unbootable when using nvidia GPU drivers. And besides, if you're really wanting that AV system to deeply know about everything the operating system is doing and hook into tons of syscalls, you pretty much can't be running exclusively in usermode. If someone compromised the root of the system you then can't trust the info the kernel is giving your usermode application. eBPF isn't usermode. And in the end, the poster literally said Windows is unsuitable because third party updates can kill it. That was the key takeaway from their post. Well, third party updates can kill Linux, it can kill MacOS, it can kill darn near everything.