Hacker News new | ask | show | jobs
by kykqx 693 days ago
It is supposed to be like that.

Antivirus software always works as a driver in the kernel, no other way. You'll get the same in Linux, for example. In MacOS it may be slightly better (if I remember right Darwin is a micro-kernel), but in fact a broken driver still can crash the system there.
1 comments
philistine 693 days ago
> Antivirus software always works as a driver in the kernel, no other way.

You're confidently wrong: https://developer.apple.com/support/kernel-extensions/

link
kykqx 693 days ago
This page is only about using some APIs, that are now supposed to be called through wrappers. I would say it significantly limits the developers, and also may introduce additional flaws.
link
philistine 693 days ago
Yet it is how antivirus works on Mac now.
link