News for hackers. Stuff that matters.

A comment on Microsoft Blames European Commission for Major Worldwide Outage. Parent comment

Re:Microsoft Blames European Commission for Major Worldwide ... by Xylakant on Monday July 22, 2024 @03:59PM (#41039126)
They absolutely could close of the kernel - it's just that Defender as an antivirus product would have to use the same APIs. Apple doesn't offer a defender-like product, so the move was easier for them.
[ Parent | on HN ]
Re:Microsoft Blames European Commission for Major Worldwide ... by yjftsjthsd-h on Monday July 22, 2024 @04:40PM (#41039582)
> Apple doesn't offer a defender-like product, so the move was easier for them.

Isn't that XProtect?

[ Parent | on HN ]
Re:Microsoft Blames European Commission for Major Worldwide ... by throwaway4pp24 on Monday July 22, 2024 @04:48PM (#41039648)
How do they close the kernel and provide API at the same time?
[ Parent | on HN ]
Re:Microsoft Blames European Commission for Major Worldwide ... by geor9e on Monday July 22, 2024 @05:01PM (#41039770)
Not a kernel-level API - they'd move Defender to an API without kernel-level access. On Mac their API is called Endpoint Security Framework which lets antivirus monitor system calls without giving it kernel-level access. And System Integrity Protection is how they close the kernel. Microsoft would love to do the same, but also want their own Defender to have kernel-level access. The EU says they have to give third-party antivirus the same access they give their own antivirus, for anti-trust reasons. Personally I disagree with the EU here.
[ Parent | on HN ]