Beaver [she/her]@lemmy.ca to Canada@lemmy.caEnglish · 7 个月前Are We Too Dependent on Microsoft?www.youtube.comexternal-linkmessage-square22fedilinkarrow-up171arrow-down16cross-posted to: linux@lemmy.mlapple_enthusiast@lemmy.world
arrow-up165arrow-down1external-linkAre We Too Dependent on Microsoft?www.youtube.comBeaver [she/her]@lemmy.ca to Canada@lemmy.caEnglish · 7 个月前message-square22fedilinkcross-posted to: linux@lemmy.mlapple_enthusiast@lemmy.world
minus-squareYaztromo@lemmy.worldlinkfedilinkarrow-up1·7 个月前You don’t have to run in Ring 0 to detect events occurring in Ring 0. Besides which, as kexts are being obsoleted by Apple getting code to run inside Ring 0 in macOS that isn’t from Apple itself is going to be extremely difficult.
minus-squareyeehaw@lemmy.calinkfedilinkarrow-up1·7 个月前Right, but part of the appeal of tools like crowd strike and sentinelone is that they can stop them when they’re in ring 0. And rollback changes. Etc.
You don’t have to run in Ring 0 to detect events occurring in Ring 0.
Besides which, as kexts are being obsoleted by Apple getting code to run inside Ring 0 in macOS that isn’t from Apple itself is going to be extremely difficult.
Right, but part of the appeal of tools like crowd strike and sentinelone is that they can stop them when they’re in ring 0. And rollback changes. Etc.