In b4 msft creates a level between kernel and user level for this stuff to sit at. It will have read-only access to all of kernel memory, and will otherwise function the same, but when it crashes it won't take the OS down, just certain programs that rely on it.

What will they call it? "Observer" level? "Big Brother" level? "Overseer" level? Probably just something to do with "Verifying Trust/Integrity". Google will also want to quietly stick something for "Web Integrity" there.

As much as I despise MS and think they are equally incompetent, I don't think it's a good idea to lock down Windows. They will stop providing kernel access to 3rd parties at first, then a few months later you will only be able to download software from the Microsoft Store.

Yes, it's a security issue but them being allowed to close down their OS sets a dangerous precedent that will make Windows even more shittier and enshittified than it already is.

MiHoYo knows that all too well.

@Wahots @mudle , I hold that same relative feeling, but people do own their computers and if they want to play League of Legends and let someone into the kernel, who am I to tell them no? I ran league in Lutris, so no chance of making that decision even if I wanted to.

Yeah, those security agents can become attack vectors themselves, so running them kernel level is nuts.

Enterprise level AVs are going to sit in the kernel so they can watch for anomalies in the OS. There are better EDRs out there than Crowdstrike, and virus definitions are an outdated way of detecting anamalous behavior anyway.

Exactly. Either they're going to make Windows Defender have the monopoly on antivirus and endpoint protection (EU will shut them down faster than a crowdstrike bluescreen), or they will need to grant the access to those providers.

If Microsoft think they will be able to curate every single device driver and other kernel module (like antivirus etc) and catch the kind of bug that caused this error? They're deluded.

I'll wait and see what they actually propose before outright ruling it out. But, I can't see how they do this in any realistic way.

According to wikipedia, both Windows and linux have it, and both are open source.

Believe it or not, a lot of companies, no matter how cool and secure their marketing sounds, are just seriously incompetent.

microsoft could get away with this monopoly accusations by opening up official read-only APIs for that, so you can have antiviruses use it and have a proper procedure for user to give consent for the antivirus to have access to said API.

In that case, the entire windows ecosystem collapses when Microsoft messes up windows defender.... at least if its spread out it hurts less people

yeah when they lose money

every corporation can learn if they lose enough money

You have a point, but if Microsoft completely locks down the kernel, preventing any third party software/driver from running at the kernel-level, Anti-Cheat developers will have to find a new way to implement Anti-Cheat. This may open up the possibility of some newer form of Anti-Cheat being user-space; or at the very least NOT ring 0, which in-turn may open up the possibility of this new form of Anti-Cheat working underneath Linux.

Or maybe we're all still screwed because this new form of Anti-Cheat will perform on a basis that trusts that there is no third party access to the Windows kernel because of how restricted it is, therefore nullifying the need to be ring 0, but it still might not work under Linux due to the freedom/access users have to the kernel.

But then again, in order to implement any third party driver into the Windows kernel, it has to be signed and/or approved by Microsoft first (IIRC). But cheaters get around this through various means. So maybe nothing changes; but if Microsoft DOES restrict kerne-level access, this leads me to think that Anti-Cheat will have to change in some form or another, which may lead to it working on Linux.

TBH, The only way(s) I see Anti-Cheat moving forward at all, is:

• Hardware level Anti-Cheat (similar to a DMA card. Maybe it requires a certain type firmware that is universally used across all/most major video game companies)

• Some form of emulated environment. Maybe like a specific kernel that is used for each game.

@dueuwuje @mudle

If I understand it correctly, it already has been (at least formally) reviewed by microsoft before signing and allowing that signed code run kernel-mode. But the crowdstrike's driver module was not just running malware scanner on itself, it was interpreting what is basically unsigned code that was easier and faster to update. This unsigned files were the ones containing faulty update.

At least that what I understand from https://www.youtube.com/watch?v=wAzEJxOo1ts , it may not be entirely correct or I may have misunderstood.

But if it is true, it may be more sensible to make an API so software with specific permissions could access information needed to effectively function as antivirus, without being run in kernel mode.