Microsoft points finger at the EU for not being able to lock down Windows

https://www.neowin.net/news/microsoft-points-finger-at-the-eu-for-not-being-able-to-lock-down-windows/

by mywacaday • 2 years ago

69 91 2 years ago

“The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers.”

Which means, if Microsoft had made a more carefully scoped way of extending the kernel, or even avoided extending the kernel at all for their own security products, they would have perfectly been at liberty to demand it for everyone else.

BLKNSLVR• 2 years ago

"Current Microsoft points finger at Past Microsoft for ..."

Isn't a headline that will ever exist, therefore they'll point fingers at any entity (EU being the most recent) that's making them do things they don't want to do in order to further an unrelated agenda.

Let no catastrophe go unexploited, as they say.

mikeocool• 2 years ago

Yeah — not to be an Apple fan boy or anything, but it appears in this case Apple did exactly that: https://support.apple.com/guide/deployment/system-and-kernel...

And made APIs available specifically for user-space EDR: https://developer.apple.com/documentation/endpointsecurity

zokier• 2 years ago

Microsoft also has userspace APIs available, such as AMSI https://learn.microsoft.com/en-us/windows/win32/amsi/antimal...

Dwedit• 2 years ago

Switching from kernelspace to userspace on every file access would eat up so much performance it would be ridiculous.

otterley5• 2 years ago

MacOS does it nowadays for endpoint protection and it works well enough. https://developer.apple.com/documentation/endpointsecurity

ern• 2 years ago

Would a bad driver update potentially have had similar consequences? (real question)

If so, this feels like a red herring.

smallnamespace• 2 years ago

Drivers undergo a vetting process by Microsoft (at least, the ones that are signed and offered as updates) = quality control through their control of the channel.

This has been the case at least since the late 90s if I remember correctly.

nullindividual2• 2 years ago

WHQL has had some pretty awful drivers pushed through it. Granted, this was quite some time ago, early 2000s-ish, but they've lead to BSODs etc with nVidia drivers.

nullindividual2• 2 years ago

Yes, of course. Plenty of storage and chipset drivers have caused no-boot scenarios.

gjsman-10003• 2 years ago

I’m afraid that one morning, we’ll wake up, Windows is unbootable globally, and it’s because the desktop Widgets had a hardcoded certificate expire, causing an infinite taskbar crash.

Which actually happened in one of the Windows 11 preview releases.

It might not be Widgets next time - but there’s enough stupid in Windows that it could be anything from SmartScreen to Defender to Copilot to Edge. It could also be just something widespread and stupid, like Intel or NVIDIA’s driver analytics imploding.

fallingsquirrel• 2 years ago

I'm reminded of the time the Windows 11 Insiders taskbar was crashing for everyone because it failed to display an ad.

https://www.neowin.net/news/how-an-ad-from-microsoft-broke-t...

toast02• 2 years ago

Windows update has a process to rollback bad driver updates after a handful of crashes, and I've seen it work. I think it's about three crashes and it rolls back. But there's probably situations where it won't work, I'm guessing things like: driver A's update causes a crash in driver B; the updated driver crashes, but not immediately; the driver crashes, but only after writing bad data to disk.

I also don't know if Microsoft's security software can rollback from bad definition updates.

ronsor• 2 years ago

driver A's update causes a crash in driver B

I can't see why this wouldn't work. A should be in B's stack trace, outside of esoteric interactions.

The rollback didn't work for the Crowdstrike problem because despite being a ".sys" file, the file that was updated wasn't a driver.

throw0101d• 2 years ago

Windows update has a process to rollback bad driver updates after a handful of crashes, and I've seen it work.

Does that include "boot-start" drivers?

A boot-start driver is a driver for a device that must be installed to start the Microsoft Windows operating system.

* https://learn.microsoft.com/en-us/windows-hardware/drivers/i...

CS designated their software as one, and when it crashed so did the whole OS to the point that the rollback process doesn't seem to be able to kick-off.

altdataseller• 2 years ago

Grewt, can the EU force Microsoft to open up their Linkedin API as well?

jmclnx• 2 years ago

The document states that Microsoft is obligated to make available its APIs in its Windows Client and Server operating systems that are used by its security products to third-party security software makers

I guess even M/S has a hard time with reading comprehension. "make available" does not mean "no lock down". So does that mean when someone boots windows into Safe Mode, they are breaking the law in the EU ? I do not think so.

j45• 2 years ago

Brainstorming - I wonder if there's a way for Microsoft to test builds of updates that could do this. It could still be hard to manage.

OptionOfT• 2 years ago

If they start to lock it down it just becomes the next iOS.

It's already horrible with their 'recommendations' left and right, and preinstalled stuff that you cannot remove.

And then it just becomes too easy for Microsoft to let their Windows Defender run in kernel mode and 3rd parties can't do that, so obviously they can outperform them.

Kinda like iOS' Safari. Hell, that one runs in user mode, but it required laws for 3rd parties to be able to provide native alternatives.

otterley5• 2 years ago

iOS is great!

An OS that is secure by design arguably needs no third-party malware protection, and therefore there's nothing to permit.

Sakos5• 2 years ago

It also makes file management a bloody nightmare, so much so that I gave up on iPhone/iPad years ago and moved back to Android. There are trade-offs. I don't want Windows to just become another MacOS or even iOS where I'm so limited in what I'm allowed to do with my system.

jmull• 2 years ago

It could become like the next macos.

numbsafari• 2 years ago

… or they could implement sufficient interfaces to the kernel that they could implement Windows Defender in a safe manner and make those same interfaces available to others.

ryukoposting2• 2 years ago

Dedicated antivirus applications like Defender are a band-aid over fundamental architectural problems with Windows. Containerization and deny-by-default access schemes would go a long way to reduce the need for those tools.

Honestly, any semblance of modern, secure system architecture would help as long as it's combined with a willingness to obsolete the bullshit that got us into this mess in the first place.

kenjackson2• 2 years ago

That take seems naive. A lot of malware works by getting the full consent of the user. Users often have no idea what they’re consenting to or the implications of it. And on top of that if you really require code to get permission for all resources they require customers will immediately look for ways to avoid having to manually do this step.

The problem is that malware has basically an infinite number of tries to get you to run something. As there is almost no consequence when they fail.

jeswin• 2 years ago

Sorry this is a simplistic take. Microsoft can easily run legacy apps in a sandbox and lock down just as much as Apple - they just wouldn't be allowed to.

Sakos5• 2 years ago

Yeah, I don't understand what people want from Microsoft here. Either they lock it down completely, and we lose control of our Windows systems, which I thought was something people here were against, or they continue to allow kernel-level access, which can be and is pretty damn useful and I wouldn't give it up for the world.

I like my Macbook, but I prefer my Windows desktop so much more because it still largely feels like my system instead of Apple's/Microsoft's.

People. Stop asking Microsoft to lock down Windows.

timnetworks• 2 years ago

We all remember that Windows was a water-tight never-crash workhorse before the pesky EU stepped in and requested the APIs to be documented for once..

bongodongobob3• 2 years ago

In an enterprise setting where you can prevent people from fucking with it, it pretty much is. M365/office is the vast majority of our help desk tickets.

antisthenes• 2 years ago

My work laptop windows crashed more times in a year than my Windows 7 install in the 10 years that I was using it (2009-2019).

Mostly due to Teams or Edge eating up all the memory, and the OS being unable to handle it gracefully.

al_borland• 2 years ago

This comment might have gone over better if people didn't just spend their whole weekend recovering from what is likely the largest outage in history, which only impacted Windows.

multimoon• 2 years ago

Even in an enterprise setting heavily controlled by group policy and an AD domain, watertight and never-crash aren’t terms I’d ever associate with any windows release.

croes• 2 years ago

Don't you forget all the withdrawn updates MS released?

MS isn't testing either.

justinclift2• 2 years ago

That's funny.

The Open Source Operating Systems that are around have much tighter security than Windows, yet their openness hasn't hurt them.

Perhaps the problem is more with Microsoft than anything else?

mc32• 2 years ago

Yes, funny... https://www.theregister.com/2024/07/21/crowdstrike_linux_cra...

justinclift2• 2 years ago

Not really sure what that's supposed to do with OS security?

ClownStrike Falcon is famously flaky software on macOS and Linux. That's no surprise to anyone.

snvzz• 2 years ago

The EU needs mandates to effectively exclude Windows from applications that are even slightly critical.

As an aside, it is sickening that so many simple displays and dedicated devices with simple UIs that could be implemented as static scenarios using proper capability-based multiserver architectures (such as the leading seL4 / LionsOS) do instead use complicated software stacks based on Linux (and sometimes even worse, Windows).

Jtsummers• 2 years ago

As an aside, it is sickening that so many simple displays and dedicated devices with simple UIs that could be implemented as static scenarios using proper capability-based multiserver architectures (such as the leading seL4 / LionsOS) do instead use complicated software stacks based on Linux (and sometimes even worse, Windows).

This has been a thing since the 90s, maybe longer. I remember walking through Caesars Palace (Las Vegas, NV) circa 1999 and seeing a BSOD on several of their screens. People will always make expedient choices as long as it works well enough most of the time.

Zamiel_Snawley• 2 years ago

LionsOS looks super interesting, I’ve wanted to use seL4 for a while but it just seemed too difficult.

userbinator• 2 years ago

I absolutely hate this focus on "security"; it's just pushing us faster towards the authoritarian dystopia that Stallman warned us about 25+ years ago.

This decision means security software vendors have a greater ability to muck up systems as CrowdStrike did this week when it crippled 8.5 million Windows PCs worldwide.

...and what about when Microsoft inevitably screws something up with its automatic updates and undoubtedly affects even more machines? They already have, multiple times. One of the most recent memorable occurrences: https://news.ycombinator.com/item?id=18189139

As the old saying goes, "Those who give up freedom for security deserve neither."

colmmacc2• 2 years ago

I'm beyond skeptical that this competition regulation prevents Microsoft from say ... having Windows roll back to the last known version of a driver/extension after a failed boot (or several). Or from having a hyper-minimal super-nanny API that uses a signed network call to add a level of control over the loading process. Or from having a built-in phased rollout API that only permits a rollout to increase in scope as more confidence is gained. And probably ten more ideas! Microsoft didn't trigger this outage, but it's very worrying if they disown it. There's a lot the OS vendor can do.

jborean932• 2 years ago

having Windows roll back to the last known version of a driver/extension after a failed boot (or several)

One of the problems with CrowdStrike was the update was a definition/config file that was pushed out by CrowdStrike. There was no driver update and the BSOD was caused by the existing driver failing to parse/load the new file pushed out. This means there was no last known good state to rollback to in terms of driver updates.

Granted I still agree that MS can hopefully improve things to avoid this problem in the future but this isn't a simple problem that the OS can guard from short of stopping 3rd party kernel drivers.

colmmacc2• 2 years ago

For robust rollback you need an encapsulation of the full dependency closure that can be rolled forwards and backwards atomically. These days containers are a decent enough solution for that. Anything changes means everything changes, at the same time. We have the technology.

perryizgr82• 2 years ago

This means there was no last known good state to rollback to in terms of driver updates.

Windows should unload the misbehaving driver after a couple of failed boots.

M95D• 2 years ago

Remember the Windows safe mode? Remember F8 step-by-step confirmation for config.sys, autoexec.bat and .vxd drivers?

Why does it have to be automatic?

tamimio• 2 years ago

Hey Microsoft: Just stop trying to cloudify everything in the new Windows and focus on its stability instead of releasing an inconsistent UI every few years, and you will be good to go.

bulla• 2 years ago

How does Microsoft's deal with one country affect its software distribution in other countries?

mkl95• 2 years ago

Did the EU ask Microsoft to build leaky, fragile abstractions too? It sounds like Microsoft's architects are a bit too comfy.

rlpb2• 2 years ago

"It's the EU's fault because they enabled competition who provided a more successful competing security product that our own security product"

throwaway4pp243• 2 years ago

A widely installed product doesn't imply a more successful product, and a more successful product doesn't imply a better product.

rlpb2• 2 years ago

What does have to do with any level of failing on the part of the EU?

Woodi• 2 years ago

Microsoft agreed back in 2009 with the European Commission that it would give makers of security software the same level of access to Windows that Microsoft gets.

Why Microsoft should have more access then others ? Becouse Crowdstrike / public internet straight to kernel updates combo ?

Whole thing is about locking _computers_ from buyers and that is a no go. We need more os'es and more freedom - just fact of MS existence (domination) is a proof that hardware-os monopoly owned by one company is not some natural law.

Now let's make IBM unlock their hardware-os monopoly to software vendors :)

gmerc• 2 years ago

Strangely Linux doesn’t have that problem.

Microsoft points finger at the EU for not being able to lock down Windows

Related Stories