4 ms·

You should explain what you're talking about if you're going to publicly trash somebody else's project > allows your junior sysadmins to take down all your mac

You should explain what you're talking about if you're going to publicly trash somebody else's project > allows your junior sysadmins to take down all your machines at once or cause mystery performance blips that someone else has to diagnose for a year Sounds like you have extremely poor administrative management of your computer systems.

jeffbee 3y ago
I don't feel like I need to be nice to Facebook. The raison d'etre of this thing is to allow interactive ad hoc exploration of large-scale systems. It is, in other words, a thoroughly bad idea.
- convolvatron 3y ago
  there may be problems with the implementation, or its usage, but I don't see why that's fundamentally a bad idea at all
  - mikermcneil 3y ago
    (used in production directly or via major EDRs by much of silicon valley, governments, and the F1000) Contributions: https://github.com/osquery/osquery https://github.com/osquery/osquery
- mikermcneil 3y ago
  osquery after Meta: https://devops.com/the-linux-foundation-breathes-new-life-into-osquery/ https://devops.com/the-linux-foundation-breathes-new-life-in...
- deleted 3y ago
  [deleted]
formerly_proven 3y ago
OS state introspection can get expensive quick and often has a performance impact beyond the process doing the sampling, because you're locking tons of kernel structures to read from them. Case in point, a simple "select * from processes" takes a solid 3 seconds of kernel time on my laptop. Now you might say, "well that's clearly a dumb idea because osquery certainly relies on vtab's colUsed field to avoid querying all sorts of expensive stuff when it doesn't have to so you really should only query what you need" and that's of course 100% true. But it's also a senior developer thought. Easy to see how an inexperienced person might make mistakes like this with any one of the dozens or hundreds of tables offered by osquery and cause performance issues. In terms of security, well it is clearly a kitchen sink project (there's a prometheus client in there, for example: https://osquery.io/schema/5.11.0/#prometheus_metrics https://osquery.io/schema/5.11.0/#prometheus_metrics), so there's a huge breadth of interfaces it talks to and files controlled by all sorts of people it parses, and the default does seem to be privileged usage, which is the general ballpark where AV engines and their highly dubious track record live.
- mikermcneil 3y ago
  Some example queries: https://fleetdm.com/queries https://fleetdm.com/queries The formula osquery uses to report performance: https://github.com/fleetdm/fleet/issues/16123 https://github.com/fleetdm/fleet/issues/16123
iJohnDoe 3y ago
Or they are a righteous developer who likes to trash people outside of development. It was a popular fad for a while, which worked both ways, such as, “Developers think they are experts in everything but couldn’t figure out how to plug in a computer.”
foobiekr 3y ago
Everyone who has experienced osquery in production when mandated from above and used by less qualified admins knew exactly what he was getting at and the simple truth of it.
- w0de0 3y ago
  I’ve used it. At large enterprises with sophisticated deployments. I disagree.
  - dherder 3y ago
    osquery has a huge span of use cases and has deep roots in system native apis, checkout a recent development in file access monitoring with osquery: https://material.security/blog/protecting-the-security-and-privacy-of-our-customers https://material.security/blog/protecting-the-security-and-p....
- mikermcneil 3y ago
  Having paved roads helps: https://github.com/fleetdm/fleet https://github.com/fleetdm/fleet

jeffbee 3y ago

I don't feel like I need to be nice to Facebook. The raison d'etre of this thing is to allow interactive ad hoc exploration of large-scale systems. It is, in other words, a thoroughly bad idea.

convolvatron 3y ago
there may be problems with the implementation, or its usage, but I don't see why that's fundamentally a bad idea at all
- mikermcneil 3y ago
  (used in production directly or via major EDRs by much of silicon valley, governments, and the F1000) Contributions: https://github.com/osquery/osquery https://github.com/osquery/osquery
mikermcneil 3y ago
osquery after Meta: https://devops.com/the-linux-foundation-breathes-new-life-into-osquery/ https://devops.com/the-linux-foundation-breathes-new-life-in...
deleted 3y ago
[deleted]

formerly_proven 3y ago

OS state introspection can get expensive quick and often has a performance impact beyond the process doing the sampling, because you're locking tons of kernel structures to read from them. Case in point, a simple "select * from processes" takes a solid 3 seconds of kernel time on my laptop. Now you might say, "well that's clearly a dumb idea because osquery certainly relies on vtab's colUsed field to avoid querying all sorts of expensive stuff when it doesn't have to so you really should only query what you need" and that's of course 100% true. But it's also a senior developer thought. Easy to see how an inexperienced person might make mistakes like this with any one of the dozens or hundreds of tables offered by osquery and cause performance issues. In terms of security, well it is clearly a kitchen sink project (there's a prometheus client in there, for example: https://osquery.io/schema/5.11.0/#prometheus_metrics https://osquery.io/schema/5.11.0/#prometheus_metrics), so there's a huge breadth of interfaces it talks to and files controlled by all sorts of people it parses, and the default does seem to be privileged usage, which is the general ballpark where AV engines and their highly dubious track record live.

mikermcneil 3y ago
Some example queries: https://fleetdm.com/queries https://fleetdm.com/queries The formula osquery uses to report performance: https://github.com/fleetdm/fleet/issues/16123 https://github.com/fleetdm/fleet/issues/16123

iJohnDoe 3y ago

Or they are a righteous developer who likes to trash people outside of development. It was a popular fad for a while, which worked both ways, such as, “Developers think they are experts in everything but couldn’t figure out how to plug in a computer.”

foobiekr 3y ago

Everyone who has experienced osquery in production when mandated from above and used by less qualified admins knew exactly what he was getting at and the simple truth of it.

w0de0 3y ago
I’ve used it. At large enterprises with sophisticated deployments. I disagree.
- dherder 3y ago
  osquery has a huge span of use cases and has deep roots in system native apis, checkout a recent development in file access monitoring with osquery: https://material.security/blog/protecting-the-security-and-privacy-of-our-customers https://material.security/blog/protecting-the-security-and-p....
mikermcneil 3y ago
Having paved roads helps: https://github.com/fleetdm/fleet https://github.com/fleetdm/fleet