Microsoft blames EU rules for allowing biggest IT outage to happen(telegraph.co.uk) |
Microsoft blames EU rules for allowing biggest IT outage to happen(telegraph.co.uk) |
MS provides a userspace interface[0] for AV vendors to do what they need to do, but they can't be forced to use it.
So yes, due to EU regulations, AV vendors can still play in kernel space, and can bring much of the world to a halt when they make a mistake as a result.
[0] https://learn.microsoft.com/en-us/windows/win32/amsi/antimal...
- could have kicked AV vendors out of kernel space, including themselves, ensuring level playing field (which is the point of EU regulations). But then they couldn't sell their product that's "isn't necessary".
- could have created other, less critical APIs to use for everyone
- could have enabled anything mandated by the EU only for the EU market
the CTOs and engineering staff are the ones in control of their machines, not M$. or at least they should be. problem is that they thought they were solving a problem by installing this kind of software, but instead were simply handing over their responsibility to a 3rd party that was totally irresponsible - and certainly doesn't accept it. they took a compliance short-cut with "box checking" software. that's where the problem lies - lack of responsibility and engineering rigor in the IT orgs.
* Updates are not vetted or sanity checked.
* Updates are not slow-rolled to production.
* Updates are not signed to prevent corruption or alteration.
* Updater does not sanitize or validate inputs.
* Updater does not have a reversion process to previously known good position on faulty boot.
* Updater should mark itself as Unnecessary For Boot on faulty boot at some point.
This causes senior management to push for the installation of this crapware/malware on their systems, overriding the objection of their system administrators who know better.
Senior management want to cover their asses, and the administrators shrug their shoulders and respond "if you say so".
In sum it is mostly a regulatory racket that is profitable for the peddlers of this crapware and for management who can claim that they did what they were required to do to stop shit from happening. Everybody wins except shareholders, customers and IT staff who have to fix this mess without getting the righteously justified overtime and bonuses.
Why do you think insurance companies have backing out of the business of insuring against these kind of disasters? They've clearly learned better.
Why do you think I stopped using Norton, MacAfee, etc, etc, and etc and opted for just decent backups and Windows own built-in stuff?
I'd suggest that there is no reason a BSOD—Blue Screen of Death—should ever occur on a system that was already working as the OS should be constructed in such a way that it can undo a faulty patch. As you'd know, there is already such a thing as Volume Shadow Copy, VSS, in MS Windows. Microsoft could have adopted this and similar techniques to ensure that the system either stayed up or rebooted.
Yes, I can hear Microsoft's retort now that doing that would make Windows more vulnerable to viruses, infiltration, etc.
To that I'd say utter bullshit, the real problem—as it has always been with Microsoft—is that it doesn't properly finish or bootstrap its code against errors before it releases it to the public. Microsoft is thus doing cheapskate engineering as it's much more profitable.
Hopefully, eventually regulators will require hardening of such software together with guarantees against such faults—guarantees that if not honored would result in enforceable financial penalties.
Only loss of income/profit is likely to fix this problem.
EU, for everyone's sake quickly debunk that deliberately misleading PR crap from Microsoft before it takes hold.
But that would cost and thus eat into MS's profits.
Oh sorry, I forgot doing that would be the ultimate sin.
Then Microsoft would have proceeded to only use this documented user land API themselves for their own Defender product and thus have no undocumented API or access advantage over other security software. The EU ruling only cares about a level playing field and not about the implementation details.
"Just regulate us less, seriously!".
Their solution to this situation is quite literally monopoly, which is hilarious.
Precisely the point I made in my comment. If Windows can initiate a BSOD then it can also initiate a reboot without said patch.
What Microsoft's PR department said is personified bullshit and needs debunking ASAP.