6 ms·
With the current model kernel level access is required. Real security products have to be able to operate above userland. Ideally in the future there can be a
by greenn 2y ago
With the current model kernel level access is required. Real security products have to be able to operate above userland. Ideally in the future there can be a layer in between userland and kernel for this sort of thing. Maybe we use some of those extra protection rings?
- ghusto 2y agoCouldn't you just ask some OS APIs provided by something in kernelspace for what you need? In fact, isn't this how macOS does things?
- mywittyname 2y agoMicrosoft was on their way to doing this, but was shot down by EU regulators because the APIs weren't available to all third-party vendors.
- armada651 2y agoI think it's kind of ridiculous to then blame the regulators for the fact that Microsoft decided not to go ahead with a more competitor-friendly design. The fact that Microsoft abandoned it as soon as a regulator pointed out how anti-competitive the design of the API was makes you wonder what Microsoft's true intention was. To me that implies the anti-competitive design was its main feature and to Microsoft it would've been pointless to continue without it.
- mywittyname 2y agoMaybe. Not working at MS I can't say what their reasons were. But another way of looking at this would be that perhaps they wanted to be the beta testers of the API themselves because opening it up would have been a maintenance liability for the company. Microsoft tends to be pretty good about backwards compatibility in ways that Apple is not. We also don't know that these APIs were cancelled, they may make it into future versions of windows.
- btilly 2y agoYou could, and in fact this is what Microsoft wanted to do. The EU said that they couldn't. And the reason why not is simple. Anything that Microsoft thinks is a good thing to add to the API, they'll add for themselves. When the new API is released, their software is released with it. This gives them a competitive advantage over competitors who have to wait for Microsoft to have the idea that they want, and then scramble to implement it after Microsoft does. The EU is suspicious of this for the simple reason that Microsoft has a several decade history of doing exactly that. Repeatedly. My favorite example being the release of Windows 95 with Microsoft Word available at the same time, and with WordPerfect unable to run. By the time WordPerfect had figured out how to port their software to Windows 95, they were no longer the market leader.
- ghusto 2y agoInteresting! I guess there's no way to fix this with further regulation either, since it would be some work to prove MS had access to the API contracts before they released them. The ultimate lesson then is to stop using MS stuff.
- lucianbr 2y agoThe way I see it, Microsoft sells some antivirus software, and also gets to decide who is allowed or not to compete with their antivirus software, by providing or denying access to the API. Obviously unfair.
- bluGill 2y agoI think anti-virus should be part of the core os. This does kill all third party vendors - good riddance to most of them, sorry if there is one that isn't evil (I'm not aware of it)
- lucianbr 2y agoOnce the AV vendors exist, killing them, especially by Microsoft, is clearly anticompetitive. If you could prevail on a government to decide that, maybe it could work. One thing I see, is that AV has a component of maintaining a DB of signatures of bad things. This does not seem at all the job of the core os. Would the Debian team maintain such a DB?
- jen20 2y ago> With the current model kernel level access is required. On Windows.
- c0balt 2y agoNote: At least on Linux the main alternatives for this, either eBPF (e.g., pulsar or falcon) or a kernel module, both require this too.
- kelnos 2y agoeBPF is at least somewhat sandboxed, no? So it doesn't quite have the access required to accidentally stomp on any portion of kernel memory it wants?
- c0balt 2y agoIndeed it's executed via a Jit on something like a VM. However it can still, make your system quite disfunctional if, e.g., all filesystem or network calls are blocked.
- vel0city 2y agoThe version of the CrowdStrike sensor that caused kernel panics on RHEL/Rocky was using eBPF. It living in eBPF doesn't mean it can't cause system instability. And as mentioned elsewhere, an eBPF module behaving badly but in valid ways can still make your system pretty unusable.
- jen20 2y agomacOS does not require this however.
- tmm 2y ago> Maybe we use some of those extra protection rings? Maybe not. Intel is considering removing rings 1 and 2 for a future 64-bit only x86 architecture, because they "are unused by modern software". https://www.intel.com/content/www/us/en/developer/articles/technical/envisioning-future-simplified-architecture.html https://www.intel.com/content/www/us/en/developer/articles/t...
- bluGill 2y agoI don't think those extra rings would be useful for what is needed anyway.