Hacker News Reader

Comment by codeulike | Hacker News Reader

Microsoft didn't blame the European Commission for the outage (thats a ridiculous headline), they said they can't close off the Kernel due to agreements made with the European Commission. The original soruce macrumors is quoting is thie WSJ article, see last paragraph: https://archive.is/FLNKH

A Microsoft spokesman said it cannot legally wall off its operating system in the same way Apple does because of an understanding it reached with the European Commission following a complaint. In 2009, Microsoft agreed it would give makers of security software the same level of access to Windows that Microsoft gets.

View on HN

They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like product, so the move was easier for them.

> Apple doesn't offer a defender-like product, so the move was easier for them.

Isn't that XProtect?

How do they close the kernel and provide API at the same time?

Not a kernel-level API - they'd move Defender to an API without kernel-level access. On Mac their API is called Endpoint Security Framework which lets antivirus monitor system calls without giving it kernel-level access. And System Integrity Protection is how they close the kernel. Microsoft would love to do the same, but also want their own Defender to have kernel-level access. The EU says they have to give third-party antivirus the same access they give their own antivirus, for anti-trust reasons. Personally I disagree with the EU here.

I find it unironic how for decades the tech community complained about the apple walled garden and how Microsoft isn't open about kernel internals and how it's hard to get things done with it compared to Linux which is open source. Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux.

I think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. While it would be funny to call out the hypocrisy in the tech world, I think the DoJ would indeed sue Microsoft unless it extracted it's own EDR and had it use the same API's it is asking other companies to use. Furthermore, there is something called the anti-malware scanner interface (AMSI) which Falcon and other EDRs indeed use and there is an ETW api that allows them to do additional monitoring as well. But that just isn't enough to counter many real world threats. In effect, the EDR must be like a rootkit to get complete system visibility and be able to stop any and all threats, kernel or userspace. Also, a user space process can prevent booting or freeze systems up.

> think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all.

Which one? Defender isn't a CS competitor.

There are multiple products called "Defender", I believe "Microsoft Defender for Endpoint" (which is an enterprise product, not the consumer Defender AV) would be considered the same.

I _think_ at least, the enterprise software space is confusing as hell :)

the enterprise version, which used to be caused defender advanced threat protection (they keep renaming it) is a direct competitor to Falcon.

> Now everyone is an EDR expert and they think Microsoft should be more like apple and less like Linux

You are responding to a statement from Microsoft that compares its own behavior to that of Apple. Why do you characterize it as everyone else thinking Microsoft should be more like Apple?

Because Microsoft is responding to "everyone" who are asking it why it is allowing EDR makers to write drivers. Win10+ only load signed drivers, so every driver is approved by Microsoft. I'm criticizing the people and journalists that are asking this question. I'm sure congress will grill Microsoft's CEO as well and ask this same question again.

There is nothing technically stopping Microsoft from addressing this.

Fixing one’s kernel extensions does not violate anticompetitive laws. It does however make for click bait headlines if you as a corp choose to troll everyone affected by CrowdStrike instead of offering mitigations.

Reply on news.ycombinator.com