4 ms·
Mac doesn't allow 3rd part kernel drivers and on Linux they use ebpf. Is their product useless there?
by Hikikomori 2y ago
Mac doesn't allow 3rd part kernel drivers and on Linux they use ebpf. Is their product useless there?
- gruez 2y ago>Is their product useless there? Probably? For instance I doubt an EDR product can detect malware being executed on iOS/Android, because all the apps there are heavily sandboxed and provide no mechanism to do invasive monitoring of everything's that's being run. >Linux they use ebpf According to wikipedia it's been ported to windows and on linux you can still load kernel modules which are crashable.
- jkrejcha 2y ago> and on Linux On Linux, they apparently had done the same thing and caused a bunch of Linux systems to crash[1]. [1]: https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/ https://www.neowin.net/news/crowdstrike-broke-debian-and-roc...