the CTOs and engineering staff are the ones in control of their machines, not M$. or at least they should be. problem is that they thought they were solving a problem by installing this kind of software, but instead were simply handing over their responsibility to a 3rd party that was totally irresponsible - and certainly doesn't accept it. they took a compliance short-cut with "box checking" software. that's where the problem lies - lack of responsibility and engineering rigor in the IT orgs.
- could have kicked AV vendors out of kernel space, including themselves, ensuring level playing field (which is the point of EU regulations). But then they couldn't sell their product that's "isn't necessary".
- could have created other, less critical APIs to use for everyone
- could have enabled anything mandated by the EU only for the EU market
* Updates are not vetted or sanity checked.
* Updates are not slow-rolled to production.
* Updates are not signed to prevent corruption or alteration.
* Updater does not sanitize or validate inputs.
* Updater does not have a reversion process to previously known good position on faulty boot.
* Updater should mark itself as Unnecessary For Boot on faulty boot at some point.
Precisely the point I made in my comment. If Windows can initiate a BSOD then it can also initiate a reboot without said patch.
What Microsoft's PR department said is personified bullshit and needs debunking ASAP.
MS provides a userspace interface[0] for AV vendors to do what they need to do, but they can't be forced to use it.
So yes, due to EU regulations, AV vendors can still play in kernel space, and can bring much of the world to a halt when they make a mistake as a result.
[0] https://learn.microsoft.com/en-us/windows/win32/amsi/antimal...