all 21 comments

sorted by: hot top controversial new old
[–] 235 points 1 year ago (9 children)

Cool. Do anticheat vendors next.

  • source
  • hideshow 9 child comments
  • [–] 57 points 1 year ago (7 children)

    Another big area of Windows that uses kernel-level drivers is anti-cheating engines for games. Microsoft has been speaking with game developers about how to reduce the amount of kernel usage, but it’s a more complicated use case as cheaters often have to purposefully tamper with their machine to disable protections and get cheating engines running.

    “A lot of [game developers] would love to not have to maintain kernel stuff, and they are very interested in how they do that,” Weston says. “We’ve been talking about the requirements there, and I think we’ll have more to say on that in the near future.” Riot Games told me last year that it’s willing to follow potential Windows security changes and “recede from the kernel space.”

  • source
  • parent
  • hideshow 7 child comments
  • [–] 28 points 1 year ago (3 children)

    I fucking called this after the Crowd Strike catastrophe.

    MSFT would start massively reworking their entire concept of who actually gets kernel access, because uh, causing a Y2K event is uh, really bad, actually.... and yep, that probably means the kernel level AC paradigm is no longer workable.

    Fucking obviously duh, wow, turns out just letting any old 'vetted' vendor submit goddamned kernel level code updates without being strenuously verified each time is a bad fucking idea, wow, who could have guessed??!?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 15 points 1 year ago (6 children)

    I wonder whether solutions like Twincat for industrial PC/PLCs will be affected by this. Interfacing directly with the kernel and replacing the scheduler are, AFAIK, fundamental to making Windows viable for real time use.

  • source
  • hideshow 6 child comments
  • [–] 3 points 1 year ago (4 children)

    An interesting question. Assuming they're only targeting security/antivirus products at the moment (see the discussion regarding anti-cheat) it may be that those applications get a pass for now.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 7 points 1 year ago (3 children)

    No I think they are limiting kernel access. These are just what moist people know that would use it.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 1 year ago

    I'm just speculating. It seems like, at least at the moment, anti cheat continues to be able to run as kernel. The article says Microsoft will have more to say on anti cheat "in the near future."

    It may be that they don't crack down on the realtime applications as hard, since the number of users impacted is so much smaller. Antivirus and anti cheat are on many millions of machines and are usable by the average consumer. Specialty software may be considered differently, I. E. "You know what you're doing and what risks you're assuming" for the more technical customer.

    It will be interesting to see where they go with this.

  • source
  • parent
  • Here’s hoping anticheat goes with them.

  • source
  • [–] 14 points 1 year ago

    Another big area of Windows that uses kernel-level drivers is anti-cheating engines for games. Microsoft has been speaking with game developers about how to reduce the amount of kernel usage, but it’s a more complicated use case as cheaters often have to purposefully tamper with their machine to disable protections and get cheating engines running.

    “A lot of [game developers] would love to not have to maintain kernel stuff, and they are very interested in how they do that,” Weston says. “We’ve been talking about the requirements there, and I think we’ll have more to say on that in the near future.” Riot Games told me last year that it’s willing to follow potential Windows security changes and “recede from the kernel space.”

  • source
  • [–] 14 points 1 year ago (1 child)

    Wouldn’t it have made more sense for them to improve the boot recovery process instead?

    If the system fails to boot after a driver update, roll back the update and inform the user on startup.

  • source
  • hideshow 1 child comment
  • 18 comments in c/technology@lemmy.ml view that post
    [–] 39 points 1 year ago

    Yay! Do anticheat next!

  • source
  • [+] 12 points 1 year ago* (last edited 1 year ago) (3 children)
  • [–] 11 points 1 year ago (1 child)

    do anticheat count as antivirus?

    No. But, from the article:

    Microsoft has been speaking with game developers about how to reduce the amount of kernel usage

    The CrowdStrike fiasco was finally enough for Microsoft to look at forcing drivers out of the kernel. This is absolutely a good thing and will hopefully lead to a more stable Windows.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 9 points 1 year ago (1 child)

    If it prevents us having another crappy week thanks to the like of Crowdstrike, good.

  • source
  • hideshow 1 child comment
  • [–] 17 points 1 year ago (4 children)

    It's good to see that M$FT is tackling the important problems:

    The sight of a Blue Screen of Death will also be a thing of the past, too. Microsoft is now officially redesigning its BSOD so that it’s black and not blue.

  • source
  • hideshow 4 child comments
  • load more comments (1 reply)
    [–] 7 points 1 year ago (1 child)

    First question which popped into my mind was, "Will they force Defender out as well?"
    Or, is Microsoft about to abuse it's position to stifle competition? Again.

  • source
  • hideshow 1 child comment
  • [–] [S] 1 point 1 year ago*

    Tbh out of the big corpos MS has been one of the least anti-competitive in the past 10-15 years. They like to push their own services with ads within their own services yes but that's not really anti competitive in the truest sense, every company on earth does that.

    The biggest one I can think of recently is them having lower rates for Windows Server on Azure vs other clouds. Compare that with companies like Apple, Google who actively attempt to put down other services.

    IMO Nadella has been pretty decent in handling that part of MS. Though I don't really have an answer to your Defender question lol.

  • source
  • parent
  • [–] 3 points 1 year ago

    I imagine that a crowd of people are asking Microsoft what made this idea strike their fancy...

  • source
  • [–] 1 point 1 year ago (3 children)

    I couldn't care less about this. Get anti cheat ba out of the kernel.

  • source
  • hideshow 3 child comments
  • [–] 10 points 1 year ago* (last edited 1 year ago) (2 children)

    It's a start. After cloudflare, they have all the ammunition needed to start removing shit like.this. Anticheat would be an amazing next move.

    Edit: crowdstrike. Oop

  • source
  • parent
  • hideshow 2 child comments
  • 3 comments in c/pulse_of_truth@infosec.pub view that post
    [–] 12 points 1 year ago

    Nothing else should be in the kernel.

  • source
  • [–] 8 points 1 year ago

    And what about anti-cheat?

  • source
  • [–] 12 points 1 year ago

    While they're at it, how about other drivers?

  • source
  • 2 comments in c/technology@lemmy.zip view that post
    [–] 9 points 1 year ago

    Almost. We still have an endless number of anti cheat packages that are allowed to run in the kernel.

  • source
  • now do anticheat

  • source