Oh FFS. I love this era where companies will not accept the blame due to “liability”, even when they are explicitly to blame.
Microsoft points finger at the EU for not being able to lock down Windows
Submitted 3 months ago by neme@lemm.ee to technology@lemmy.world
Comments
apfelwoiSchoppen@lemmy.world 3 months ago
Blue_Morpho@lemmy.world 3 months ago
We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.
They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer.
It’s no different than Linux in that way. If you install a buggy device driver on Linux, that’s your/the driver’s fault, not Linux.
Cyth@lemmy.world 3 months ago
I actually agree, I own my computer / OS and I should be able to do what you’re saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.
kescusay@lemmy.world 3 months ago
The thing is, Microsoft’s virus-scanning API shouldn’t be able to BSOD anything, no matter what third-party software makes calls to it, or the nature of those calls. They should have implemented some kind of error handler for when the calls are malformed.
So this is really a case of both Crowdstrike and Microsoft fucking up. Crowdstrike shoulders most of the blame, of course, but Microsoft really needs to harden their API to appropriately catch errors, or this will happen again.
NeoNachtwaechter@lemmy.world 3 months ago
They are legally required to let Crowdstrike crash your computer.
I call Bullshit.
If it had been Windows NT 3.5, there would have been no bluescreens around the world. It had stopped the buggy software, gave a message accordingly, and continued it’s job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.
Now you tell me that Windows NT 3.5 is illegal?
umami_wasbi@lemmy.ml 3 months ago
But what if Windows have something similar to eBPF in Linux, and CS opted to use it, will this disaster won’t happen at all or in a much smaller scale and less impactful?
admin@lemmy.my-box.dev 3 months ago
We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.
Sorry, how is that related to the stability of the kernel?
0x0@programming.dev 3 months ago
Yeah I saw the article that says they’re legally required but until I can actually read that document where it says “thou shall give everyone ring-0” access I’m gonna call it bullshit.
conciselyverbose@sh.itjust.works 3 months ago
Fuck Microsoft and fuck Windows.
But if you inject hacky bullshit third party code into someone’s OS that breaks things, it’s not the OS’s fault.
kureta@lemmy.ml 3 months ago
But in this case Microsoft certified the driver. If they knew the driver included an interpreter that can run arbitrary code, they shouldn’t have certified it because they can not fully test it. If they didn’t know, then their certification test are inadequate. Most of the blame lies with the security software. If Microsoft didn’t certify it, they would have had zero fault.
jabjoe@feddit.uk 3 months ago
I’m sorry, but competition is good.
Installing some closed blob into your kernel, that’s on you.
The problem is if anything not enough competition. We just saw a centralized monoculture fall over.
skymtf@lemmy.blahaj.zone 3 months ago
Blaming the EU is stupid MacOS is locked down, for the EU it’s more about apps less about the kernel space.
ammonium@lemmy.world 3 months ago
Security software are also “apps”. Since Microsoft is also in the security software business locking down access for their competitors could definitely be seen as anti-competitive practices.
Apple doesn’t have a monopoly with MacOS so other rules apply.
skymtf@lemmy.blahaj.zone 3 months ago
My issue with that is Android is also pretty locked down and most certainly does have a monopoly, in general I think it’s just MS being stupid.
woelkchen@lemmy.world 3 months ago
Meanwhile a Microsoft employee on how to prevent such an issue under Linux: www.phoronix.com/…/systemd-Auto-Boot-Assessment
30p87@feddit.org 3 months ago
a Microsoft employee
You’re talking about good ol’ Lenny like he isn’t the author of the most used init and utility system as well as PulseAudio.
woelkchen@lemmy.world 3 months ago
I know who that is and he’s also a Microsoft employee these days which makes this a funny sequence of statements:
“EU bad because they made us open up Windows to 3rd party anti-virus vendors. Oh, btw, the fully open Linux operating system can cope with such a problem if properly configured. Here’s the documentation to make that configuration.”
800XL@lemmy.world 3 months ago
I don’t know enough about Windows 10/11, but aren’t they supposed to boot into a menu thet allows you to pick the last known good configuration before it evens boots to the gui?
kevindqc@lemmy.world 3 months ago
The problem is with a specific file on the disk, not a misconfiguration
jonc211@programming.dev 3 months ago
Apparently it’s because CrowdStrike installed their device driver as one that must start when Windows starts.
Explained here: youtu.be/wAzEJxOo1ts?feature=shared&t=675
I’ve linked to the specific time where he explains that issue, but tbh the whole video is worth watching.
woelkchen@lemmy.world 3 months ago
It’s been a while since I had such a massive problem under Windows but the last time you could try to restore one of the last backups and usually that failed because Windows restore points are/were crap.
Zak@lemmy.world 3 months ago
The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers.
The document does not, however say those APIs have to exist. Microsoft could eliminate them for its own security products and then there would be no issue.
catloaf@lemm.ee 3 months ago
Is this even relevant? Wasn’t it a kernel driver module?
brianorca@lemmy.world 3 months ago
It’s a third party kernel module, which Microsoft would love to be able to block, but legally can’t. It’s technically possible to write a virus scanner that runs in user space instead of the kernel, but it’s easier to make sure everything gets scanned if it’s in the kernel.
HubertManne@moist.catsweat.com 3 months ago
even when it was the bears I knew it was regulation and taxes.
Damage@feddit.it 3 months ago
I’m pretty sure that if Microsoft provided a decent way to do what Crowdstrike does, most companies would opt for that.
So… Sucks to suck I guess.
Buelldozer@lemmy.today 3 months ago
Uhhh they do. Defender for Endpoint. It’s available as both P1 and P2 depending on what you need.
BearOfaTime@lemm.ee 3 months ago
Why should MS do that? I guess if they saw a market value for it, they could. Like how Defender came to be after 20 years of third party anti-virus.
They certainly developed the tech for it - I remember reading about some of their research circa 2000 making the OS and everything on it a database. They’ve kind of been working that direction for years (see MyLifeBits).
I suppose they could provide an add-on tool for this, but I suspect there’s a political barrier (imagine the blowback of MS providing such a tool).
0x0@programming.dev 3 months ago
The document that outlines the agreement between Microsoft and the European Commission is available as a Doc file on Microsoft’s website.
admin@lemmy.my-box.dev 3 months ago
Personally, I don’t see the issue. Microsoft shouldn’t be responsible for when a third party creates a buggy kernel module.
And when you, as a company, decide to effectively install a low-level rootkit on all your machines in hopes that it will protect you against whatever, you accept the potential side effects. Last week, those side effects occurred.
OfCourseNot@fedia.io 3 months ago
Hard to say yet, if Microsoft is responsible or not. The thing is they certified it, as a stable and tested driver. But it isn't just a driver, but an interpreter/loader that loads code at runtime and executes it. In kernel mode. If Microsoft knew this they're definitely responsible for certifying it, but maybe crowdstrike hid this behavior until it was deployed to the customers.
zewm@lemmy.world 3 months ago
It was my understanding that this wasn’t certified. Crowdstrike circumvented the signing process.
0x0@programming.dev 3 months ago
MS gives them access, so they’re responsible.
www.youtube.com/watch?v=wAzEJxOo1ts
admin@lemmy.my-box.dev 3 months ago
I disagree. As someone else in this thread said: if you compile a buggy Linux driver that crashes the system, it’s still the fault of the driver.
henrikx@lemmy.dbzer0.com 3 months ago
I bet you love your locked down iPhone too