Hacker News Reader

Comment by Reason077 | Hacker News Reader

> ”This is not a windows issue. This is a third party security vendor shitting in the kernel.“

Sure, but Windows shares some portion of the blame for allowing third-party security vendors to “shit in the kernel”.

Compare to macOS which has banned third-party kernel extensions on Apple Silicon. Things that once ran as kernel extensions, including CrowdStrike, now run in userspace as “system extensions”.

View on HN

Back in 2006 the Microsoft agreed to allow kernel level access for Security companies due to an EU anti trust investigation. They were being sued by anti virus companies because they were blocking kernel access in the soon to be released Vista.

https://arstechnica.com/information-technology/2006/10/7998/

Wow, that looks like a root cause

Wow! First cookie pop-ups, now Blue Friday...?

Sick and tired of EU meddling in tech. If third parties can muck around in the kernel, then there's nothing Microsoft can really do at that point. SMH

Can they simultaneously allow this, but recommend against it and deny support / sympathy if you do it to your OS?

Yes... in the same sense that if a user bricks their own system by deleting system32 then Windows shares some small sliver of the blame. In other words, not much.

the difference is you can get most of the functionality you want without deleting system32, but if you want the super secure version of NT, you have to let idiots push untested code to your box.

linux, Solaris, BSD and macOS aren't without their flaws, but MSFT could have done a much better job with system design.

Why should Windows let users delete system32? If they don't make it impossible to do so accidentally (or even maliciously), then I would indeed blame Windows.

On macOS you can't delete or modify critical system files without both a root password and enough knowledge to disable multiple layers of hardware-enforced system integrity protection.

lol. Never said they should, did I?

And what do you think installing a deep level antivirus across your entire fleet is equivalent to?

...but still, if the user space process is broken, MacOS will fail as well. Maybe it's a bit easier to recover, but any broken process with non-trivial privileges can interrupt the whole system.

It's certainly not supposed to work like that. In the kernel, a crash brings down the entire system by design. But in userspace, failed services can be restarted and continued without affecting other services.

If a failure in a userspace service can crash the entire system, that's a bug.

It's kind of inevitable that a security system can crash the system. It just needs to claim than one essential binary is infected with malware, and the system won't run.

Reply on news.ycombinator.com