Possible future vmm(4)/vmd(8) on arm64

In an exciting move,
Mike Larkin (mlarkin@)
has
requested
hardware for
vmm(4)
development on the arm64 platform:

CVSROOT:	/cvs
Module name:	www
Changes by:	mlarkin@cvs.openbsd.org	2024/07/27 18:31:12

Modified files:
	.              : want.html 

Log message:
Mac mini M2 needed for vmm(4) development.

This follows
several
earlier
commits
[by Dave Voutila (dv@)]
splitting
vmm(4)/vmd(8)
into
MI
and MD
parts.

Microsoft’s CrowdStrike post-mortem

Microsoft has published a post-mortem of the CrowdStrike incident, and goes into great depths to describe where, exactly, the error lies, and how it could lead to such massive problems. I can’t comment anything insightful on the technical details and code they show to illustrate all of this – I’ll leave that discussion up to you – but Microsoft also spends considerable amount of time explaining why security vendors are choosing to use kernel-mode drivers. Microsoft lists three major reasons why security vendors opt for using kernel modules, and none of them will come as a great surprise to OSNews readers: kernel drivers provide more visibility into the system than a userspace tool would, there are performance benefits, and they’re more resistant to tampering. The downsides are legion, too, of course, as any crash or similar issue in kernel mode has far-reaching consequences. The goal, then, according to Microsoft, is to balance the need for greater insight, performance, and tamper resistance with stability. And while the company doesn’t say it directly, this is clearly where CrowdStrike failed – and failed hard. While you would want a security tool like CrowdStrike to perform as little as possible in kernelspace, and conversely as much as possible in userspace, that’s not what CrowdStrike did. They are running a lot of stuff in kernelspace that really shouldn’t be there, such as the update mechanism and related tools. In total, CrowdStrike loads four kernel drivers, and much of their functionality can be run in userspace instead. It is possible today for security tools to balance security and reliability. For example, security vendors can use minimal sensors that run in kernel mode for data collection and enforcement limiting exposure to availability issues. The remainder of the key product functionality includes managing updates, parsing content, and other operations can occur isolated within user mode where recoverability is possible. This demonstrates the best practice of minimizing kernel usage while still maintaining a robust security posture and strong visibility. Windows provides several user mode protection approaches for anti-tampering, like Virtualization-based security (VBS) Enclaves and Protected Processes that vendors can use to protect their key security processes. Windows also provides ETW events and user-mode interfaces like Antimalware Scan Interface for event visibility. These robust mechanisms can be used to reduce the amount of kernel code needed to create a security solution, which balances security and robustness. ↫ David Weston, Vice President, Enterprise and OS Security at Microsoft In what is surely an unprecedented event, I agree with the CrowdStrike criticism bubbling under the surface of this post-mortem by Microsoft. Everything seems to point towards CrowdStrike stuffing way more things in kernelspace than is needed, and as such creating a far larger surface for things to go catastrophically wrong than needed. While Microsoft obviously isn’t going to openly and publicly throw CrowdStrike under the bus, it’s very clear what they’re hinting at here, and this is about as close to a public flogging we’re going to get. Microsoft’s post-portem further details a ton of work Microsoft has recently done, is doing, and will soon be doing to further strenghthen Windows’ security, to lessen the need for kernelspace security drivers even more, including adding support for Rust to the Windows kernel, which should also aid in mitigating some common problems present in other, older programming languages (while not being a silver bullet either, of course).

Mercado projeta inflação maior para 2024 e 2025; Alan Ghani analisa

Video by via Dailymotion Source Analistas consultados pelo Banco Central elevaram a expectativa para a alta do IPCA para 2024 e 2025, de acordo com a mais recente pesquisa Focus divulgada nesta segunda-feira (29). Alan Ghani analisou. Assista ao Jornal da Manhã completo: https://youtube.com/live/w0gAtmHrSfM Baixe o app Panflix: https://www.panflix.com.br/ Inscreva-se no nosso canal:https://www.youtube.com/c/jovempannews Siga o … Read more

How to Edit Monetizable Shorts for TikTok

Video by via Dailymotion Source How to Edit Monetizable Shorts for TikTok As tarah k agr video edit karthay hai to TikTok pr ap copyright content b upload kar sakthay hai koyi issue apko nahi aye ga. TikTok video editing, TikTok Monetizable Shorts, TikTok viral shorts Go to Source

Ika-2 tanker na lumubog sa Bataan kasunod ng MT Terra Nova, pinalibutan ng oil spill boom | 24 Oras

Video by via Dailymotion Source Dalawang lumubog na motor tanker na ang binabantayan ng coast guard sa Bataan dahil sa banta ng oil spill. Bukas na sisipsipin ang milyong litro industrial fuel ng MT Terra Nova ang dahilan ng fishing ban sa Limay, Bataan at sa Bulacan. 24 Oras is GMA Network’s flagship newscast, anchored … Read more

Tutorial Bikin Banner Channel Youtube

Video by via Dailymotion Source Cara atau Tutorial Membuat Banner atau Tulisan di Channel YouTube Membuat banner atau tulisan yang dipampang diakun channel YouTube bagian paling atas, penting. Agar channel kita enak dan nyaman dilihat, selain itu agar channel kita, lebih terlihat profesional. Berikut ini panduan langkah demi langkah cara atau tutorial untuk membuat banner … Read more