EU Has 'No Intention' to Repeal DMA Following Apple Challenge

[Abazigal]

The only problem was that AV vendors should have the same access as Microsoft's AV tools. If Microsoft had said, "fine, everybody, including us, only has access from outside the Kernel," that would have been fine and is what they are actually now doing.

Which raises the question - barring EU legislation, what exactly is the issue with Microsoft reserving kernel access for themselves while blocking every other third party vendor from being able to access it? Some misguided notion of “fairness”?

 

[MilaM]

Which raises the question - barring EU legislation, what exactly is the issue with Microsoft reserving kernel access for themselves while blocking every other third party vendor from being able to access it? Some misguided notion of “fairness”?

Think about it from the perspective of users of security software. I'm not talking about consumers, but huge corporations who have to manage and secure thousands if not millions of PCs in their orgs. Do they want another tech monopoly in this crucial area? Or do they prefer to have a range of competing vendors to choose from. MS can't possibly provide security solutions that will cover all the needs that those organisations might have. It's much better to have some competition and a range of vendors to choose from.

Just as an aside. Apple already has similar APIs for the kernel/OS that MS is now developing. It's called Endpoint Security. Third party vendors can plug into it and provide the services large corporations need to manage their fleets of Macs.

 

[surferfb]

Microsoft should have done the right thing back then and do what they are doing now, pull the AV software out of the Kernel and make secure APIs for monitoring purposes. Instead, they just capitulated without actually taking a stand for more security.

The only problem was that AV vendors should have the same access as Microsoft's AV tools. If Microsoft had said, "fine, everybody, including us, only has access from outside the Kernel," that would have been fine and is what they are actually now doing.

In 2006 Microsoft tried to lock down Vista!

AV companies complained to the EU , the EU publicly warned Microsoft, and in response Microsoft created new kernel-level interfaces so AV companies could still operate under PatchGuard rather than locking the door like Microsoft had wanted to do.

That decision, made under duress in response to the EU, made widespread third-party kernel drivers the norm, which I guess was good for competition, but is terrible for users when a vendor pushes a bad update.

So now, 20 years later, years after Apple did so, and it’s clear even to the EU the harms of not doing so, Microsoft is moving out of the kernel, which they could have done earlier if EU pressure hadn’t pushed them to keep third-party drivers deep in the OS.

 

[MilaM]

AV companies complained to the EU , the EU publicly warned Microsoft, and in response Microsoft created new kernel-level interfaces so AV companies could still operate under PatchGuard rather than locking the door like Microsoft had wanted to do.

Here is the wording of the EU-MS agreement:

Microsoft shall ensure on an ongoing basis and in a Timely Manner that the APIs in the Windows Client PC Operating System and the Windows Server Operating System that are called on by Microsoft Security Software Products are documented and available for use by third-party security software products that run on the Windows Client PC Operating System and/or the Windows Server Operating System.

Do you see kernel-level access mentioned here? No. Nothing prevented Microsoft from implementing out-of-kernel APIs to mitigate what happened with Crowdstrike. Why did they not do it? Who knows. It would have been the prudent thing to do as we now know.

Source: https://www.theregister.com/2024/07/22/windows_crowdstrike_kernel_eu/

Another quote by the journalist who wrote the article above:

However, nothing in that undertaking would have prevented Microsoft from creating an out-of-kernel API for it and other security vendors to use. Instead, CrowdStrike and its ilk run at a low enough level in the kernel to maximize visibility for anti-malware purposes. The flip side is this can cause mayhem should something go wrong.

 

[Abazigal]

Microsoft should have done the right thing back then and do what they are doing now, pull the AV software out of the Kernel and make secure APIs for monitoring purposes. Instead, they just capitulated without actually taking a stand for more security.

Part of me wonders if the reason why Microsoft did nothing pre-Crowdstrike was the fear of antitrust lawsuits. It's kinda ironic if Crowdstrike had to happen in order to provide the conditions that would let Microsoft justify what they are doing right now with zero pushback from legislators, now that everyone knows what is at stake.

 

[surferfb]

Here is the wording of the EU-MS agreement:



Do you see kernel-level access mentioned here? No. Nothing prevented Microsoft from implementing out-of-kernel APIs to mitigate what happened with Crowdstrike. Why did they not do it? Who knows. It would have been the prudent thing to do as we now know.

Source: https://www.theregister.com/2024/07/22/windows_crowdstrike_kernel_eu/

Another quote by the journalist who wrote the article above:

Again, Microsoft tried in Vista, AV companies pushed back and the EU publicly warned Microsoft not to.

Just because the text doesn’t say “shall provide kernel access” doesn’t mean the EU regulations discouraged Microsoft from doing the right thing. Because they literally did. Remember “spirit of the law”, not what the text says.

This idea that there are literally no downsides to regulations and negative consequences are never the regulations’ fault, but rather the company’s fault is insane.

 

[MilaM]

This idea that there are literally no downsides to regulations and negative consequences are never the regulations’ fault, but rather the company’s fault is insane.

Putting all the blame of one (admittedly huge and rather public) security incident solely on regulation is also insane. There is no panacea for human error. You can't run huge fleets of PCs without security software. Do you know for sure, that such an incident would not have happened, if Microsoft locked out all competing security vendors out of the operating system?

 

[JonathanX64]

Apple said the DMA's rules put EU iPhone owners at risk of malware, fraud, and invasions of privacy.

And living in a non-EU country puts iPhone owners at risk of not being able to install the software they want on the devices they own.

A far greater risk than malware infection, which shouldn’t be possible anyway if iOS was secure by design.

 

[surferfb]

Putting all the blame of one (admittedly huge and rather public) security incident solely on regulation is also insane. There is no panacea for human error. You can't run huge fleets of PCs without security software. Do you know for sure, that such an incident would not have happened, if Microsoft locked out all competing security vendors out of the operating system?

I don’t put all of the blame on the regulation. But it literally wouldn’t have happened had the regulation not been in place. Which means a very large part of the blame does indeed fall on the EU, despite their and their defenders’ protestations otherwise.

 

[turbineseaplane]

"by increasing the feature set to be comparable to an alternate platform, with more features, the user is faced with fewer choices"

"More choice is actually less choice. Also, war is peace. And freedom is subjugation"


Welcome to upside-down-land, where water is dry, black is white and down is up.

 

[I7guy]

And living in a non-EU country puts iPhone owners at risk of not being able to install the software they want on the devices they own.

That’s not a risk. You own the hardware not the software.

A far greater risk than malware infection, which shouldn’t be possible anyway if iOS was secure by design.

If Microsoft cant secure windows after so many years, what makes you believe that 100% operating systems are capable of being programmed.