Comment on Microsoft points finger at the EU for not being able to lock down Windows

apfelwoiSchoppen@lemmy.world ⁨1⁩ ⁨month⁩ ago

• Blue_Morpho@lemmy.world ⁨1⁩ ⁨month⁩ ago

  We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

  They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer.

  It’s no different than Linux in that way. If you install a buggy device driver on Linux, that’s your/the driver’s fault, not Linux.

  source

  • Cyth@lemmy.world ⁨1⁩ ⁨month⁩ ago

    I actually agree, I own my computer / OS and I should be able to do what you’re saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.

    source

    • Blue_Morpho@lemmy.world ⁨1⁩ ⁨month⁩ ago

      You are going to give grief to Microsoft for allowing what you want?

      ???

      source
    • Feyd@programming.dev ⁨1⁩ ⁨month⁩ ago

      That doesn’t make any sense. How does arguing against your position do anything but harm it?

      Maybe just give them grief over the myriad negative things they do that don’t counter your position?

      source
  • kescusay@lemmy.world ⁨1⁩ ⁨month⁩ ago

    The thing is, Microsoft’s virus-scanning API shouldn’t be able to BSOD anything, no matter what third-party software makes calls to it, or the nature of those calls. They should have implemented some kind of error handler for when the calls are malformed.

    So this is really a case of both Crowdstrike and Microsoft fucking up. Crowdstrike shoulders most of the blame, of course, but Microsoft really needs to harden their API to appropriately catch errors, or this will happen again.

    source

    • Heavybell@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I don’t believe there was any specific API in use here, for virus scanning or not. I suppose maybe the device driver API? I am not a kernel developer so I don’t know if that’s the right term for it.

      Crowdstrike’s driver was loaded at boot and caused a null pointer dereference error, inside the kernel. In userspace, when this happens, the kernel is there to catch it so only the application that caused it crashes. In kernelspace, you get a BSOD because there’s really nothing else to do.

      youtube.com/watch?v=wAzEJxOo1ts

      source

      • kescusay@lemmy.world ⁨1⁩ ⁨month⁩ ago

        I stand corrected. For some reason, I was thinking they used the actual Windows Defender API, which can be called programmatically from third-party applications, but you’re correct, it was a driver loaded at boot. Microsoft isn’t at all at fault, here.

        source
    • catloaf@lemm.ee ⁨1⁩ ⁨month⁩ ago

      Isn’t that API what the article is talking about?

      source

      • kescusay@lemmy.world ⁨1⁩ ⁨month⁩ ago

        Nope. It’s a lower level kernel API that has to be accessed at boot via a driver. The API I was thinking of - and I use the term “thinking” loosely, here - is an API that userspace applications can take advantage of to scan files after boot is already complete.

        source
  • NeoNachtwaechter@lemmy.world ⁨1⁩ ⁨month⁩ ago

    They are legally required to let Crowdstrike crash your computer.

    I call Bullshit.

    If it had been Windows NT 3.5, there would have been no bluescreens around the world. It had stopped the buggy software, gave a message accordingly, and continued it’s job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.

    Now you tell me that Windows NT 3.5 is illegal?

    source

    • MinFapper@startrek.website ⁨1⁩ ⁨month⁩ ago

      You could absolutely install software on Windows 3.5 that would crash the system.

      source

      • OfCourseNot@fedia.io ⁨1⁩ ⁨month⁩ ago

        Can confirm. I've crashed most Microsoft products from msdos 5.

        source

        • -> View More Comments
    • Blue_Morpho@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I ran 3.5. Yes, a network driver crash would blue screen NT3.5. Graphics were in user space in 3.5 so a video driver couldn’t take NT 3.5 down but networking was in the kernel. en.m.wikipedia.org/wiki/Hybrid_kernel

      source

      • NeoNachtwaechter@lemmy.world ⁨1⁩ ⁨month⁩ ago

        a network driver crash would blue screen NT3.5.

        OK, and… Were the legally required to make it crash?

        source

        • -> View More Comments
  • umami_wasbi@lemmy.ml ⁨1⁩ ⁨month⁩ ago

    But what if Windows have something similar to eBPF in Linux, and CS opted to use it, will this disaster won’t happen at all or in a much smaller scale and less impactful?

    source

    • nevemsenki@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Crowdstrike managed to fuck up Linux through eBPF just as well.

      access.redhat.com/solutions/7068083

      If you load hacky shit into the kernel it can always find a way to make a nasty surprise. eBPF is a little bit better fence, not some miracle that automatically fixes shitty code.

      source

      • umami_wasbi@lemmy.ml ⁨1⁩ ⁨month⁩ ago

        🤦‍♂️

        source
  • admin@lemmy.my-box.dev ⁨1⁩ ⁨month⁩ ago

    We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

    Sorry, how is that related to the stability of the kernel?

    source

    • Blue_Morpho@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I explained in my second sentence.

      “They are legally required to give Crowdstrike or anyone low level access to the OS.”

      If you install a buggy driver into Linux and it crashes, that’s not a problem with the Linux kernel.
      www.redhat.com/sysadmin/linux-kernel-panic

      source

      • admin@lemmy.my-box.dev ⁨1⁩ ⁨month⁩ ago

        I fully agree with you on that front, but ads have nothing to do with kernel access, so how is that relevant to their legal requirements?

        source

        • -> View More Comments
  • 0x0@programming.dev ⁨1⁩ ⁨month⁩ ago

    Yeah I saw the article that says they’re legally required but until I can actually read that document where it says “thou shall give everyone ring-0” access I’m gonna call it bullshit.

    source

    • Blue_Morpho@lemmy.world ⁨1⁩ ⁨month⁩ ago

      If it’s not ring 0, it’s not full access. They are legally required to give full access.

      source

      • 0x0@programming.dev ⁨1⁩ ⁨month⁩ ago

        I’ll believe it when I read it.

        source

        • -> View More Comments
• conciselyverbose@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

  Fuck Microsoft and fuck Windows.

  But if you inject hacky bullshit third party code into someone’s OS that breaks things, it’s not the OS’s fault.

  source

  • kureta@lemmy.ml ⁨1⁩ ⁨month⁩ ago

    But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn’t have certified it because they can not fully test it. If they didn’t know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn’t certify it, they would have had zero fault.

    source

    • conciselyverbose@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

      Certifying a driver is not an endorsement.

      It is a verification that it is legitimately from who it claims to be from. Microsoft has zero fault, period.

      source

      • kureta@lemmy.ml ⁨1⁩ ⁨month⁩ ago

        The Windows Hardware Certification program (formerly Windows Hardware Quality Labs Testing, WHQL Testing, or Windows Logo Testing) is Microsoft’s testing process which involves running a series of tests on third-party device drivers, and then submitting the log files from these tests to Microsoft for review. The procedure may also include Microsoft running their own tests on a wide range of equipment, such as different hardware and different Microsoft Windows editions.

        source

        • -> View More Comments
      • umami_wasbi@lemmy.ml ⁨1⁩ ⁨month⁩ ago

        I had a read about the WHQL (which I assumes what certified means). It uses the Windows HLK to perform a series of tests, which submited to Microsoft, and only then the driver will be signed.

        While certification isn’t endorsement, the testing and the resulting certification implies basic compatibility and reliability. And causing bootloops and BSODs is anywhere but close to “basic compatibility and reliability.”

        source

        • -> View More Comments