Comments by "" (@grokitall) on "Mental Outlaw" channel.

  1. a broken kernel patch can crash any kernel, due to the lack of safeguards inherent in running in kernel space. the problem here is the inept recovery method in windows which kept the machines rebooting in the hope that the buggy driver would somehow magically fix itself.
    7
  2. no, it was anti competitive because they did not want defender to have to play by the same rules. they could just have had defender use the same apis that they wanted to force on everyone else, but chose to remove them instead. this choice was made by microsoft, not the eu.
    6
  3. the 8ssue with patchguard was that it created a 2 tier system, effectively handing the antivirus market to microsoft. the eu said no have another go. microsoft could have kept patchguard and undertook to have everyone including windows defender move to it by service pack 1, but chose not to.
    4
  4. the issue here was not the update, but live patching a kernel driver without bothering to do any testing. previously, they just got lucky.
    3
  5. we have know how to do this since windows 3.11, and it is simple. do not ship untested code! of course we have got better at testing since then.
    3
  6. however they try to implement it, it won't work in this case. for this type of software to work, it needs its grubby little fingers everywhere. for containers to work, it needs to limit where those fingers can go, so the 2 solutions are fundamentally incompatible.
    2
  7. people have been looking for ways to reduce the cost of microkernels in terms of context switching and message passing since the 1970s. so far, everything tried which speeds up microkernels also speeds up monolithic kernels as well, which is why no mainstream os vendor ships a pure microkernel.
    2
  8. simple, cloudstrike did not bother to put the patch through testing.
    1
  9. this sort of thing was standard practice in a lot of the companies that got hit, but cloudstrike shipped this as a live patch, which updates immediately without caring which driver version you are using. this basically overrode every security policy their customers had in place to prevent this. then they shipped the update to 8.5 million mission critical machines without doing any testing. we have known not to do that since windows 3.11.
    1
  10. nobody ships a pure microkernel design as a mainstream operating system. a case can be made that apple has a microkernel, but lots of stuff online disputes that, and in any case they don't support the enterprise market, so it probably does not fit the people who got hit. any kernel level code can read or write anywhere, and can thus crash any kernel if it has a bug. the issue here is that microsoft did not detect and disable the buggy driver.
    1
  11.  @donpalmera  like the eu ban lies, the enclave thing is just pr. to the extent that it works, it is incompatible with this sort of software. what microsoft needed to do was make it so that the boot start flag told the kernel that it wanted to force the kernel not to finish booting if there was a problem, then let the kernel override it if the driver was buggy. they did not do this despite having boot loop issues in 2016, 2018, 2022, 2023, and now this time.
    1
  12. no, microsoft wanted to let defender be a first class citizen, and force everyone else to use the patchguard api. the eu said no, think again. microsoft could have shipped patchguard, but not enforced it until service pack 1, at which time defender would also have to use it, but they chose not to.
    1
  13. sandboxing won't help in this case, as the 2 needs are not compatible.
    1
  14. it does not work that way. you either need the capabilities of kernel mode, or you don't. if you need them, you are stuck in kernel space, and can do this. if you don't, you should stay in user space where you only kill yourself. there is no ring 1 space where you get the advantages of kernel space but not the risks. ring 0-n is a processor feature which gives you increasingly guarded access to the machines capabilities. in the old 8 bit days, everything was basically kernel space. everything could write everywhere. it is only with the development of multi user operating systems on mainframes that the idea of user space actually came to exist, and the idea of processor level access restrictions made any sense.
    1
  15. windows defender is basically just an antivirus, like norton or macafee. edr software is an order of magnitude more comprehensive in the types of malware it can work against, even before you consider the proactive nature of most of the companies involved.
    1
  16.  @rockets4kids  actually it is. anything executable goes through testing including canary releasing. if it crashes the machine during phased rollout you stop shipping it. then it does not end up on the customers machines. where is the difficulty in that?.
    1
  17.  @rockets4kids  obviously it did not work in this case
    1
  18. if microsoft had undertook to make defender use patchguard as well, and to not restrict everyone until service pack 1, they could have implemented it. they chose not to. edr software does way more than just antivirus, so defender 8s irrelevant.
    1
  19. being on linux is no defense. your nvidia driver could do the same thing if buggy and untested.
    1
  20. you are wrong. a lot of companies were required to install this type of software by their insurance companies, and are required by law to have insurance.
    1
  21. microsoft has had boot loop issues before and not fixed it, so when the lawsuits come in, it will be their problem.
    1
  22. really, everything i read says they ripped it out of vista, and nothing else mentions it.
    1
  23. apple is not comparable, as they don't sell into the enterprise space, so most of the users would not be using apple.
    1
  24.  @whatcouldgowrong7914  i mean apple don't do servers for mission critical jobs, not that apple do not have any products used by people working for businesses. the needs are different. also an apple machine is basically an all in one computer, and they only provide a few designs at once. this is different from a general purpose platform like linux or windows which has to support anything that can be plugged into a suitable slot.
    1
  25. there are various reasons some driver code might need to be run in kernel mode, on pretty much any kernel for any os. it was not the fact it was kernel code which did this, it was the fact they shipped untested code, which nobody serious has done since windows 3.11.
    1
  26.  @ibrahim-tech  microsoft and the companies had various measures in place, cloudstrike subverted them. the file they shipped was either supposed to contain rules which a driver resident engine was supposed to apply, or contained executable pcode, both of which bypassed Microsofts driver signing process. then they shipped it as a live update, without doing any tests worth mentioning, which bypassed the companies n-1 driver update policies.
    1
  27. due to the way reactos is developed, stating if it is in beta or not does not really make sense. in conventional development, it follows a big bang model, where you rush to get it feature complete, then move to beta, where you rush to make it stable, then release it as version 1.0. in open source development it works differently, with this process going on at the patch level, not the kernel level. this means reactos is technically alpha, as it is not yet feature complete, and against the moving target that is windows, it might remain that way. however the code that has been implemented is usually very stable. most crashes are caused by a software update trying to use an unimplimented feature it did not use before.
    1
  28. they already do. they just let cloudstrike set the boot start flag, and then did not override it and disable the driver on reboot, causing the boot loop.
    1