Because I've tried using LLMs to generate code and I've seen the results. They are not usable. They *resemble* valid code, but they typically throw exceptions and raise errors, they can't pass unit tests, and they don't correctly handle edge cases. AI-generated code is a mess that *superficially looks right* but isn't fit to purpose.

There is a meme going around about the fact that you can tackle a normal coding task by spending 3 hours to write code and 1 hour to debug and test it, or you can use CoPilot to spend 15 minutes to write the code and 8 hours to debug and test it. That matches my experience.

"The area that Google did well in that would not have happened had I not been distracted is Android, where it was a natural thing for me. I was trying, although what I didn't do well enough is provide the operating system for the phone. That was ours for the taking."

The antitrust case was overturned by the Appellate Court in 2001. The DOJ and Microsoft settled the outstanding portions in November 2001.

Android Inc. was started in 2003, and was four guys using pre-existing Open Source components to build an OS for mobile phones. Google bought them in 2005, and the first handset using Android was released in 2008.

Bill, you had seven years and the entire backing of a massive corporation (including all of its employees and intellectual property) after the antitrust case was settled, and couldn’t pull off what four guys started and Google finished in five using Open Source components.

Yaz

It’s not as if Microsoft leaves them a whole lot of choice. Since Windows NT 3.1, Windows has only ever supported two of the four Intel rings of execution — Ring 0 (kernel mode) and Ring 3 (user mode). If drivers had the option of running in Ring 1 they could potentially be isolated when they misbehave without risking corrupting kernel structures — but that option doesn’t exist. The only place where CrowdStrike Falcon Sensor can functionally run on Windows is in Ring 0. That’s a Windows architecture flaw IMO.

AFAIK there are no sufficient APIs to allow Ring 3 processes in Windows to monitor kernel events.

In contrast, on macOS CrowdStrike Falcon Sensor runs as a System Extension entirely in user space (Ring 3 on Intel; I’m not sure if Apple Silicon uses the same notation). It used to be a kext (kernel extension) that ran in Ring 0/kernel mode, but after Apple introduced Endpoint Security Framework (and limitations to running/installing kexts on Apple Silicon) CrowdStrike redeveloped Falcon Sensor to use these new facilities to run completely in Ring 3. Had this flaw hit macOS, the OS simply would have isolated the misbehaving Falcon Sensor without crashing the system.

So I’d say it’s less that CrowdStrike “insisted” on “god level” privs on Windows than it is that they don’t have any choice. Where they do have choice (macOS) they run in plain old user mode — and by all accounts, continue to function just as well as they ever did running in kernel mode.

Yaz

I’ll admit I’ve never done development with fanotify, so I’m open to being corrected here.

From what I understand of fanotify, it’s well suited for something like a virus scanner — but what CrowdStrike Falcon Sensor does is much more than file-level scanning. It’s also doing in-memory checks, and looks for patterns of events that may indicate malicious activity.

Indeed, the P-code file that killed Windows instances the other week was intended to check for certain types of improper use of Windows named pipes (one of the reasons why the flaw didn’t affect any other platforms was that only Windows was vulnerable to the type of attack being monitored, and thus macOS and Linux didn’t require that specific p-code). From what I understand of fanotify, it wouldn’t have been useful in this situation.

Yaz