• Blue_Morpho@lemmy.world
    link
    fedilink
    English
    arrow-up
    87
    arrow-down
    12
    ·
    edit-2
    3 months ago

    We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

    They are legally required to give Crowdstrike or anyone complete low level access to the OS. They are legally required to let Crowdstrike crash your computer. Because anything else means Microsoft is in control and not the software you installed.

    It’s no different than Linux in that way. If you install a buggy device driver on Linux, that’s your/the driver’s fault, not Linux.

    • TimeSquirrel@kbin.melroy.org
      link
      fedilink
      arrow-up
      57
      arrow-down
      1
      ·
      edit-2
      3 months ago

      You are not wrong, but people don’t want to hear it. Do we want to retain control over what goes into kernel space or not? If so, we have to accept that whatever we stuff in there can crash the entire thing. That’s why we have stuff like driver signatures. Which Crowdstrike apparently bypassed with a technical loophole from how I understand it.

    • umami_wasabi@lemmy.ml
      link
      fedilink
      English
      arrow-up
      4
      ·
      3 months ago

      But what if Windows have something similar to eBPF in Linux, and CS opted to use it, will this disaster won’t happen at all or in a much smaller scale and less impactful?

    • kescusay@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      9
      ·
      edit-2
      3 months ago

      The thing is, Microsoft’s virus-scanning API shouldn’t be able to BSOD anything, no matter what third-party software makes calls to it, or the nature of those calls. They should have implemented some kind of error handler for when the calls are malformed.

      So this is really a case of both Crowdstrike and Microsoft fucking up. Crowdstrike shoulders most of the blame, of course, but Microsoft really needs to harden their API to appropriately catch errors, or this will happen again.

      I’m an idiot. For some reason, I was thinking about the Windows Defender API, which can be called from third-party applications.

      • Heavybell@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        3 months ago

        I don’t believe there was any specific API in use here, for virus scanning or not. I suppose maybe the device driver API? I am not a kernel developer so I don’t know if that’s the right term for it.

        Crowdstrike’s driver was loaded at boot and caused a null pointer dereference error, inside the kernel. In userspace, when this happens, the kernel is there to catch it so only the application that caused it crashes. In kernelspace, you get a BSOD because there’s really nothing else to do.

        https://youtube.com/watch?v=wAzEJxOo1ts

        • kescusay@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          ·
          3 months ago

          I stand corrected. For some reason, I was thinking they used the actual Windows Defender API, which can be called programmatically from third-party applications, but you’re correct, it was a driver loaded at boot. Microsoft isn’t at all at fault, here.

        • kescusay@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          Nope. It’s a lower level kernel API that has to be accessed at boot via a driver. The API I was thinking of - and I use the term “thinking” loosely, here - is an API that userspace applications can take advantage of to scan files after boot is already complete.

    • NeoNachtwaechter@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      15
      ·
      edit-2
      3 months ago

      They are legally required to let Crowdstrike crash your computer.

      I call Bullshit.

      If it had been Windows NT 3.5, there would have been no bluescreens around the world. It would have stopped the buggy software, given a message accordingly, and continued it’s job. That Windows was not stupid enough to crash itself just because of a null pointer in another software.

      Now you tell me that Windows NT 3.5 is illegal?

          • Blue_Morpho@lemmy.world
            link
            fedilink
            English
            arrow-up
            5
            ·
            3 months ago

            Not then, but European anti trust lawsuits resulted in laws that require Microsoft to allow 3rd parties complete access. That means if the 3rd party software is a low level driver, it will crash the system. They are legally required to allow vendors the level of access that can crash the system.

          • BearOfaTime@lemm.ee
            link
            fedilink
            English
            arrow-up
            4
            ·
            3 months ago

            They were legally required to permit third party to install a kernel mode driver.

          • MinFapper@startrek.website
            link
            fedilink
            English
            arrow-up
            4
            ·
            3 months ago

            A better comparison would be an iPhone. Apple has locked that down so much that it’s impossible to install something like CrowdStrike falcon, thus it’s not possible for something like this to happen.

            Microsoft is saying if the EU would let them, they too could lock down their platform enough to prevent this from happening.

            However, I would prefer to maintain control over my device and do what I want with it, instead of just what Apple/Microsoft want; even if that means I might break my device.

    • just another dev@lemmy.my-box.dev
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      10
      ·
      3 months ago

      We all hate Microsoft for turning Windows into an ad platform but they aren’t wrong.

      Sorry, how is that related to the stability of the kernel?

    • 0x0@programming.dev
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      11
      ·
      3 months ago

      Yeah I saw the article that says they’re legally required but until I can actually read that document where it says “thou shall give everyone ring-0” access I’m gonna call it bullshit.

          • OfCourseNot@fedia.io
            link
            fedilink
            arrow-up
            8
            ·
            3 months ago

            It might not be written literally like that but for Microsoft not letting third party developers write kernel drivers for windows would be considered abusing their position in the market very fast. The problem isn’t they allow kernel drivers, this is just ms throwing all the balls they can, is that they certified this very driver, as tested and stable. Without this certification most IT teams would’ve been more reticent to install crowdstrike’s root kit in their systems.

    • Cyth@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      20
      ·
      3 months ago

      I actually agree, I own my computer / OS and I should be able to do what you’re saying (install and break things). But Microsoft is a trillion dollar multi national corporation and I am certainly going to give them grief about this because I owe them less than nothing, let alone any good will.

      • Feyd@programming.dev
        link
        fedilink
        English
        arrow-up
        11
        ·
        3 months ago

        That doesn’t make any sense. How does arguing against your position do anything but harm it?

        Maybe just give them grief over the myriad negative things they do that don’t counter your position?