Microsoft Blames European Commission for Major Worldwide Outage

[frenchcamp49er]

The EU is doing wonders for consumers 🤣🤣🤣🤣🤣🤣🤣

 

[CapitalIdea]

That’s a reach, Microsoft. The EU has no problem with security, just anti-competitive behaviour. The two are not equivalent.

In the EU it’s anticompetitive to have a locked door.

 

[AppliedMicro]

1) It will always be stronger to secure an OS on the kernel-level.
2) The EU says if you sell a kernel-level product, you must allow kernel-level access to 3rd parties.
3) Allowing kernel-level access to third parties is, as we've all just witnessed, a bad idea.
4) The EU then says "so don't sell a kernel-level security product!
5) But if MS doesn't provide a kernel-level security product, windows will be less secure.
6) Lather, Rinse, Repeat.

1. But Microsoft has and had no intention to. Cause $$$
2. Which they’re allowing to many anyway.
3. Yet they’re doing it anyway. And pretty indiscriminately.
4. They aren‘t. They‘re just saying you can give yourself an unfair advantage in selling it.
5. Others can provide it, too.

Microsoft being the operating system vendor does not mean they’re the best-suited vendor to offer security products for it. If they were, why do vulnerabilities exist in the first place.

 

[Timo_Existencia]

Roll it into the price of Windows.

Given how important it is for infrastructure and critical infrastructure, yes, it should be secure with paying on top.

The only way that would work would be to make Windows a subscription based service, where you are paying an ongoing fee. And as I understand it, the EU would consider that a "product" and thus require something more from MS>

You seem to not understand that security at this level is an intensive and ongoing cost.

 

[bradman83]

I'm not understanding your position here.

Microsoft will ALWAYS have access to the kernel. As it should be. But more importantly, so many of you who support the EU have made "open the operating system!" your central mantra. And now you're saying "close the os!"

No one is saying the OS has to be completely open, people are saying that apps by the OS maker should be on a level playing field with third party apps.

If CrowdStrike Falcon has to run in user space, so should Microsoft Defender.

If Firefox has to run in user space, so should Safari (which it does).

OS vendors like Microsoft and Apple can add access to the core of the OS via APIs without actually exposing the kernel.

 

[Timo_Existencia]

The question in this case is what is the minimum functionality that should be bundled with a general purpose?

Security at this scale, the Enterprise scale, cannot be bundled into the OS for the initial cost.

The idea that you and others think it can be is a huge part of the problem here. And why the EU and the DMA simply cannot create the utopia you seem to think it can create.

 

[Joshuaorange]

Backdoors: If you build it, they will come.

I think you misspelled… eh, never mind..

 

[Abazigal]

As I read it (and linked to the document earlier in this thread).

Yes - as long as they aren’t giving their own products (security software, in this case, it seems) anunfair advantage by excepting them.

Personally, I would consider this the lesser of two evils, but to each their own, I suppose.

 

[Timo_Existencia]

No one is saying the OS has to be completely open, people are saying that apps by the OS maker should be on a level playing field with third party apps.

If CrowdStrike Falcon has to run in user space, so should Microsoft Defender.

Security at the level of enterprise security needs will always be better coded for kernel-level access.

So you're either asking MS to allow NO security programs at the kernel-level, or all 3rd parties have access to the kernel.

Again, not a great argument.

 

[CapitalIdea]

Or, you know, Microsoft could blame the actual company, CloudStrike, responsible for the outage. That’s like blaming the government for a traffic accident because they set the speed limit.

People routinely blame, sue, and win cases against the government for failure to provide proper speed limits and maintenance of dangerous intersections.

 

[wbeasley]

Of course.

They will be even more in arms when kernel-level drivers aren’t working anymore.
Cause it would be even more expensive for legacy applications- which particularly the enterprise segments runs a lot of.

then that's no solution...

this weakness is now known by the entire IT world.
and we know those who actively exploit weaknesses will be excited to use this knowledge.

no IT department can just sit on their hands and rely on hope.

To quote Spock "the needs on the one do not outweigh the needs of the many". Surely.

how do you deal with legacy code? well if Macs and Linux bit the bullet it can be done. some pain no doubt for a few using that code. but is there a feasible way around that?

 

[bzgnyc2]

This example perfectly represents the problem with the DMA and the EU's entire approach:

1) It will always be stronger to secure an OS on the kernel-level.
2) The EU says if you sell a kernel-level product, you must allow kernel-level access to 3rd parties.
3) Allowing kernel-level access to third parties is, as we've all just witnessed, a bad idea.
4) The EU then says "so don't sell a kernel-level security product!
5) But if MS doesn't provide a kernel-level security product, windows will be less secure.
6) Lather, Rinse, Repeat.

If 2 made sense it would still not be true. There's no such thing as a "kernel-level product". What the EU said is that whatever APIs you use for your products you have to let others use. The corrolary to this is that if you can't make products without adding extensions to the kernel, then others need to be able to do so too.

3) Kernel-level access is required to get certain things done in the absence of well thought out APIs covering all the various needs. And the breadth and depth of use cases covered by MS is beyond imagine. Though many Windows machines are used as glorified Chromebooks, there are many use cases well beyond the Chromebook/App model.

4-5-6) If MS wants 3rd parties out of the kernel (which up until now they haven't since it's almost the ecosystem is extremely diverse) they would just need to do what Apple did and create APIs (all the frameworks under system extensions) to accomplish the same goals.

Note that removing 3rd party access to the kernel won't eliminate the risks of errant code in privileged applications entirely. It just reduces the risk. I am sure a whacky, out-of-control system extension could take down a Mac too. It's just much less likely.

 

[CapitalIdea]

The real reason the Mac ecosystem and assorted OS’s are not meaningful in this conversation is because they do not run anything in this world of consequence.

Aside from, you know, APPLE.

 

[Timo_Existencia]

I'll say again, I love the features that Apple can build by tightly controlling the walled garden and ecosystem. Security and interoperability are central to why I chose and remain with Apple.

And the DMA sees both of those things as "problems."

You all can have your Microsoft Windows and Android systems.

I've chosen a different path and there's no argument by which I concede that the EU trying to take my choice away is a win for me (or for consumers).

 

[bzgnyc2]

then that's no solution...

this weakness is now known by the entire IT world.
and we know those who actively exploit weaknesses will be excited to use this knowledge.

no IT department can just sit on their hands and rely on hope.

To quote Spock "the needs on the one do not outweigh the needs of the many". Surely.

how do you deal with legacy code? well if Macs and Linux bit the bullet it can be done. some pain no doubt for a few using that code. but is there a feasible way around that?

Linux has pretty substantial backwards compatability including a general promise not to break the ABI. Linux adds and morphs but anything that breaks the ABI is considered a bug.

Also note Linux doesn't restrict people from adding things to the kernel. If anything it's the opposite model -- anyone can add things to the kernel at any time. Plus kernel development is open source so vendors can get their additions to the kernel part of the mainstreamed.

The flip side of the latter is that such code undergoes a lot of review including at the conceptual level (i.e. does this even need to be in the kernel?).

What's different about Linux when it comes to CS is that after CS messed up Linux the first time they said hey you could do all the same things from user space so maybe get out of the kernel. And the nature of the Linux culture is that when the community tells a vendor their design is bad, they tend to fall in line or get ignored. That doesn't happen in Windows world where people tend to just click Yes, Yes, Yes, Accept, Accept, Accept and send me an invoice.

 

[patmondal]

I'll say again, I live the features that Apple can build by tightly controlling the walled garden and ecosystem. Security and interoperability are central to why I chose and remain with Apple.

And the DMA sees both of those things as "problems."

You call can have your Microsoft Windows and Android systems.

I've chosen a different path and there's no argument by which I concede that the EU trying to take my choice away is a win for me (or for consumers).

Exactly. Give us options. I thought it was the free market and let people choose...
If the people want a closed OS, they'll get that. If they want open access and do anything they want, they'll get that.

By forcing Apple to be more like Android and Windows, EU is taking choice away from consumer instead of giving them more choices.

 

[WolfSnap]

It's ALMOST like the EU's politicians have no idea about how computers and software work...

 

[Timo_Existencia]

What's different about Linux when it comes to CS is that after CS messed up Linux the first time they said hey you could do all the same things from user space so maybe get out of the kernel. And the nature of the Linux culture is that when the community tells a vendor their design is bad, they tend to fall in line or get ignored. That doesn't happen in Windows world where people tend to just click Yes, Yes, Yes, Accept, Accept, Accept and send me an invoice.

So, in other words, there's already a healthy marketplace where people can choose different products to support?

Who knew?

 

[Minato1990]

I don’t like Microsoft but I can get behind it.
**** the EU!!!!

 

[dwaite]

how is it the EU's fault?

The EU requires Microsoft to give third parties the level of kernel access which results in them being able to take down the entire machine for competitive reasons. This is because Microsoft has this level of access (as the author of the operating system).

Depending on their agreement with the EU, Microsoft might instead _only_ provide this level of access to machines running in the EU, which would effectively force vendors to go through safer mechanisms in order to address the larger market.

This is effectively what Apple seems to want to do with their AI features - they are not planning to ship them in the EU (at least for now) because the AI gets access to a database with tons of very personal user information across first and third party apps, and they don't want third parties to get open access to this under the guise of releasing a competitive AI product.

 

[bzgnyc2]

I'll say again, I love the features that Apple can build by tightly controlling the walled garden and ecosystem. Security and interoperability are central to why I chose and remain with Apple.

And the DMA sees both of those things as "problems."

You all can have your Microsoft Windows and Android systems.

I've chosen a different path and there's no argument by which I concede that the EU trying to take my choice away is a win for me (or for consumers).

You're projecting your needs and desires on to all consumers. There are at least 5 billion people on the Internet spanning an almost incomprehensive ranges of cultures many of whom interact with more than 1 device for different purposes.

 

[AppliedMicro]

this weakness is now known by the entire IT world.
and we know those who actively exploit weaknesses will be excited to use this knowledge.

No bew revelation at all.
The risks of kernel-level drivers have been known forever.

how do you deal with legacy code? well if Macs and Linux bit the bullet it can be done. some pain no doubt for a few using that code. but is there a feasible way around that?

For good or worse, backwards compatibility has been a cornerstone of Microsoft’s business model.

So you're either asking MS to allow NO security programs at the kernel-level, or all 3rd parties have access to the kernel.

Again, not a great argument.

Tasking the company that made a vulnerable product in the first place with securing it - or claiming it’s the company that can do it best: not a great argument.

 

[bzgnyc2]

The EU requires Microsoft to give third parties the level of kernel access which results in them being able to take down the entire machine for competitive reasons. This is because Microsoft has this level of access (as the author of the operating system).

It's not because has access to its own kernel that 3rd parties can access the kernel. It's because MS can't meet end-user needs without writing kernel extensions/drivers. If anything that's the accepted and documented way to get certain things done in Windows. If MS created API could address the needs currently being met by kernel level extensions/drivers and then used them for their own software then they could force 3rd parties to do the same. They haven't up until now.

Depending on their agreement with the EU, Microsoft might instead _only_ provide this level of access to machines running in the EU, which would effectively force vendors to go through safer mechanisms in order to address the larger market.

The Windows platform was never designed to limit kernel access and would have to undergo substantial redesign to limit access. Apple has spent over 5 years working on this and still hasn't eliminated all kernel access despite a narrower range of use cases and hardware to support.

 

[AppliedMicro]

The EU requires Microsoft to give third parties the level of kernel access

…as far as their competing products use it themselves.

Depending on their agreement with the EU, Microsoft might instead _only_ provide this level of access to machines running in the EU

Their providing kernel-level access anyway, for a huge number of applications.
Such as, mentioned already, anti-cheat drivers for online games.
Let alone a myriad of hardware device drivers, including legacy ones.

The only way that would work would be to make Windows a subscription based service, where you are paying an ongoing fee.

Which is basically what it is.
Upgrades aren’t free and support periods are limited.

 

[Hypereides]

I have to agree with Microsoft on this one. Say what you will about their market share…ever since this became required of Microsoft (to open up their kernel) it only was a matter of when not if eventually an incident like this would occur. This falls mostly on Crowdstrike, who appears to have clearly not fully tested and or piloted their update — but make no mistake, the EU opened this door (forced Microsoft to open this door) 15 years ago. The EU is also why you are charging your iPhones from 15 on up with a USB-C cable not a lightening cable.