Microsoft is moving antivirus providers out of the Windows kernel
www.theverge.com
Microsoft wants to avoid another CrowdStrike incident.

Microsoft has long wanted to get vendors out of the kernel. It’s a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.

Most of those issues also apply to kernel anti-cheat as well, and it’s likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.

  • LedgeDrop@lemmy.zip
    2·
    11 hours ago

    I hope that it’s fear-mongering.

    I tried to justify the technical reasons here, but the tl;dr is it possible for windows 11 to verify that the OS and hardware are “unmodified” (aka “attestation”).

    They tried to do this in the past, arguing that anything that wanted kernel-level access had to Windows API calls instead, however Windows Defender which was bundled with the OS was exempt from this restriction.

    True but attestation is a different beast. It’s just a hardware check that “everything is unmodified”. Any/all software vendors can use it. Windows Defender was a “duplication” of functionality (hence the EU smackdown).

    However, as Microsoft has already integrated attention into Windows 11 (restricted to verifying security patches, for the moment) - it’ll be easier for them to repackage attestation into a simple API that software vendors (games/apps/even websites) and use (if attestation.check('basic') == true; then run; else exit).

    This “simple” check is what software companies have been wanting for years: a way to guarantee that users are running their software in the way that the software companies want you to be running it (meaning unmodified).

    The OPs original question was about removing anti-cheat - which I’m confident will happen and will be replaced with attention (as it already exists for android, John deere, iphones, etc).

    Your points about virus scanners is different: I think virus scanners, although technically not necessary (after attestation is mandatory) - they will still exist, simply because virus scanners is a 40+ Billion Dollar industry. Microsoft cannot/will not piss of those companies “just because they can” - it would be in the shareholders best interests for Microsoft to throw the virus scanner companies a bone, allow them an isolated space to do their thing, charge them for the privilege, and require that Microsoft verifies that the virus scanner is untampered.