4 ms·

I hope though that Microsoft will double down on their eBPF support for Windows after this incident.

stackskipton 2y ago
Doubt it. Microsoft is clearly over Windows. They continue to produce it but every release feels like "Ugh, fine, since you are paying me a ton of money." Internally, Microsoft is running more and more workloads on Linux and externally, I've had .Net team tell me more than once that Linux is preferred environment for .Net. SQL Server team continues to push hard for Linux compatibility with every release. EDIT: Windows Desktop gets more love because they clearly see that as important market. I'm talking more Windows Server.
- WatchDog 2y ago
  SQL Server has supported Linux since 2017
- kevincox 2y ago
  They aren't over windows. They continue to be incredibly interested in and actively developing how much money they can suck from their users. Especially via various forms of ads. But yeah, kernel features are few and far between.
  - rob74 2y ago
    See also: https://en.wikipedia.org/wiki/Cash_cow https://en.wikipedia.org/wiki/Cash_cow
  - queuebert 2y ago
    I believe the term you are looking for is "rent seeking". Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? (I'm being generous with XP, because actually 95 was already mostly internet ready.) Yet how many times have many of us paid for a Windows license on a new computer or because the old version stopped getting updates?
    - vitus 2y ago
      > Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? Modern crypto ciphersuites that aren't utterly broken? Your best options for symmetric crypto with XP are 3DES (officially retired by NIST as of this year) and RC4 (prohibited in TLS as of RFC 7465). (And if you think 3DES isn't totally broken by itself, you're right... except for the part where the ciphersuite in question is in CBC mode and is vulnerable to BEAST. Thanks, mandated ciphersuites.)
    - wolrah 2y ago
      > Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? XP->Vista alone brought a bunch of huge changes that massively improved security (UAC), capability (64 bit desktops), and future-proofing (UEFI) among many many other things. Some helpful Wikipedia editors have answered this question in excessive detail, so I'm just going to link those for more info. Also I'm going to start with what XP changed from 2003 both because it makes a good comparison and I'd argue 2000/NT 5.0 is the root of the modern Windows era. Your next sentence after the quote implies you probably won't have a problem with that. * XP/2003: https://en.wikipedia.org/wiki/Features_new_to_Windows_XP https://en.wikipedia.org/wiki/Features_new_to_Windows_XP * 2003R2: https://en.wikipedia.org/wiki/Windows_Server_2003#Windows_Server_2003_R2 https://en.wikipedia.org/wiki/Windows_Server_2003#Windows_Se... * Vista: https://en.wikipedia.org/wiki/Features_new_to_Windows_Vista https://en.wikipedia.org/wiki/Features_new_to_Windows_Vista * 2008: https://en.wikipedia.org/wiki/Windows_Server_2008#Features https://en.wikipedia.org/wiki/Windows_Server_2008#Features * 7: https://en.wikipedia.org/wiki/Features_new_to_Windows_7 https://en.wikipedia.org/wiki/Features_new_to_Windows_7 * 2008R2: https://en.wikipedia.org/wiki/Windows_Server_2008_R2#New_features https://en.wikipedia.org/wiki/Windows_Server_2008_R2#New_fea... * 8: https://en.wikipedia.org/wiki/Features_new_to_Windows_8 https://en.wikipedia.org/wiki/Features_new_to_Windows_8 * 2012: https://en.wikipedia.org/wiki/Windows_Server_2012#Features https://en.wikipedia.org/wiki/Windows_Server_2012#Features * 8.1: https://en.wikipedia.org/wiki/Windows_8.1#New_and_changed_features https://en.wikipedia.org/wiki/Windows_8.1#New_and_changed_fe... * 2012R2: https://en.wikipedia.org/wiki/Windows_Server_2012_R2#Features https://en.wikipedia.org/wiki/Windows_Server_2012_R2#Feature... * 10: https://en.wikipedia.org/wiki/Features_new_to_Windows_10 https://en.wikipedia.org/wiki/Features_new_to_Windows_10 * 2016: https://en.wikipedia.org/wiki/Windows_Server_2016#Features https://en.wikipedia.org/wiki/Windows_Server_2016#Features * 2019: https://en.wikipedia.org/wiki/Windows_Server_2019#Features https://en.wikipedia.org/wiki/Windows_Server_2019#Features * 2022: https://en.wikipedia.org/wiki/Windows_Server_2022#Features https://en.wikipedia.org/wiki/Windows_Server_2022#Features * 11: https://en.wikipedia.org/wiki/Features_new_to_Windows_11 https://en.wikipedia.org/wiki/Features_new_to_Windows_11 * 2025: https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025 https://learn.microsoft.com/en-us/windows-server/get-started... Obviously some of this will be "fluff" and that's up to your own personal definitions, but to act like there haven't been significant changes in every major revision is just nonsense.
- throwaway2037 2y ago
  This claim about SQL Server: Is it due to disk access being slower from NT kernel compared to Linux kernel?
  - stackskipton 2y ago
    It's just easier for everyone involved (outside Windows GUI clicker admins) if it runs on Linux. Containerization is easier, configuration is easier and operating system is much more robust.
    - psd1 2y ago
      Operating system can be more robust, depending on admin skill. Let idiots configure and operate your rhel and you may not get those five nines. There are costs to it, in the form of architectural baggage and slower iteration, but what windows brings to the table is a deck swept mostly clear of footguns. That can give you a different form of robustness.
  - marcosdumay 2y ago
    There's something very wrong with Windows disk access, you can see it easily by trying to run a Windows desktop with rotating disks. But SQL Server is in the unique position of being able to optimize Windows for their own needs. So they shouldn't have this kind of problem.
    - devbent 2y ago
      The file system is almost 30 years old. When NTFS came out it was way better than anything on Linux. Heck even in 2006 NTFS was better. But Linux keeps getting new file systems while Windows keeps NTFS.
      - marcosdumay 2y ago
        AFAIK, NTFS is a perfectly ok design. But the Windows file system never performed well. This is probably not for architectural reasons. And no, it didn't perform better at NT4, XP, or Win7 times.
- mosburger 2y ago
  > SQL Server team continues to push hard for Linux compatibility with every release. It's kinda funny that the DB that was once a fork of Sybase that was ported to Windows is trying to make its way back to Unix.
benfortuna 2y ago
Keep in mind they don't just allow any old code to execute in the kernel. They do have rigorous tests (WHQL), it's just Crowdstrike decided that was too burdensome for their frequent updates, and decided to inject code from config files (thus bypassing the control). The fault here is entirely with Crowdstrike.
- capitainenemo 2y ago
  Is there any evidence that the config files had arbitrary code in them? The only analysis I'd seen so far indicated a parsing error loading a viral signature database that was routinely updated, but in this case was full of garbage data.
  - benfortuna 2y ago
    Perhaps not verified, but some smart people do have convincing arguments: https://youtu.be/wAzEJxOo1ts?si=UNNxAN27VV1E6mcP&t=505 https://youtu.be/wAzEJxOo1ts?si=UNNxAN27VV1E6mcP&t=505
    - capitainenemo 2y ago
      Any article/blog/text-that-can-be-read?
      - alecco 2y ago
        Don't bother. He just repeats a tweet saying a null+offset dereference and also the speculation of that null picked from the sys file.
- remram 2y ago
  How rigorous are the tests if faulty data can brick the machine?
  - dwattttt 2y ago
    Not rigorous enough to have detected this flaw in the kernel sensor, although effectively any bug in this situation (an AV driver) can brick a machine. I imagine WHQL isn't able to find every possible bug in a driver you submit to them, they're not your QA team.

Doubt it. Microsoft is clearly over Windows. They continue to produce it but every release feels like "Ugh, fine, since you are paying me a ton of money." Internally, Microsoft is running more and more workloads on Linux and externally, I've had .Net team tell me more than once that Linux is preferred environment for .Net. SQL Server team continues to push hard for Linux compatibility with every release. EDIT: Windows Desktop gets more love because they clearly see that as important market. I'm talking more Windows Server.

WatchDog 2y ago
SQL Server has supported Linux since 2017
kevincox 2y ago
They aren't over windows. They continue to be incredibly interested in and actively developing how much money they can suck from their users. Especially via various forms of ads. But yeah, kernel features are few and far between.
- rob74 2y ago
  See also: https://en.wikipedia.org/wiki/Cash_cow https://en.wikipedia.org/wiki/Cash_cow
- queuebert 2y ago
  I believe the term you are looking for is "rent seeking". Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? (I'm being generous with XP, because actually 95 was already mostly internet ready.) Yet how many times have many of us paid for a Windows license on a new computer or because the old version stopped getting updates?
  - vitus 2y ago
    > Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? Modern crypto ciphersuites that aren't utterly broken? Your best options for symmetric crypto with XP are 3DES (officially retired by NIST as of this year) and RC4 (prohibited in TLS as of RFC 7465). (And if you think 3DES isn't totally broken by itself, you're right... except for the part where the ciphersuite in question is in CBC mode and is vulnerable to BEAST. Thanks, mandated ciphersuites.)
  - wolrah 2y ago
    > Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? XP->Vista alone brought a bunch of huge changes that massively improved security (UAC), capability (64 bit desktops), and future-proofing (UEFI) among many many other things. Some helpful Wikipedia editors have answered this question in excessive detail, so I'm just going to link those for more info. Also I'm going to start with what XP changed from 2003 both because it makes a good comparison and I'd argue 2000/NT 5.0 is the root of the modern Windows era. Your next sentence after the quote implies you probably won't have a problem with that. * XP/2003: https://en.wikipedia.org/wiki/Features_new_to_Windows_XP https://en.wikipedia.org/wiki/Features_new_to_Windows_XP * 2003R2: https://en.wikipedia.org/wiki/Windows_Server_2003#Windows_Server_2003_R2 https://en.wikipedia.org/wiki/Windows_Server_2003#Windows_Se... * Vista: https://en.wikipedia.org/wiki/Features_new_to_Windows_Vista https://en.wikipedia.org/wiki/Features_new_to_Windows_Vista * 2008: https://en.wikipedia.org/wiki/Windows_Server_2008#Features https://en.wikipedia.org/wiki/Windows_Server_2008#Features * 7: https://en.wikipedia.org/wiki/Features_new_to_Windows_7 https://en.wikipedia.org/wiki/Features_new_to_Windows_7 * 2008R2: https://en.wikipedia.org/wiki/Windows_Server_2008_R2#New_features https://en.wikipedia.org/wiki/Windows_Server_2008_R2#New_fea... * 8: https://en.wikipedia.org/wiki/Features_new_to_Windows_8 https://en.wikipedia.org/wiki/Features_new_to_Windows_8 * 2012: https://en.wikipedia.org/wiki/Windows_Server_2012#Features https://en.wikipedia.org/wiki/Windows_Server_2012#Features * 8.1: https://en.wikipedia.org/wiki/Windows_8.1#New_and_changed_features https://en.wikipedia.org/wiki/Windows_8.1#New_and_changed_fe... * 2012R2: https://en.wikipedia.org/wiki/Windows_Server_2012_R2#Features https://en.wikipedia.org/wiki/Windows_Server_2012_R2#Feature... * 10: https://en.wikipedia.org/wiki/Features_new_to_Windows_10 https://en.wikipedia.org/wiki/Features_new_to_Windows_10 * 2016: https://en.wikipedia.org/wiki/Windows_Server_2016#Features https://en.wikipedia.org/wiki/Windows_Server_2016#Features * 2019: https://en.wikipedia.org/wiki/Windows_Server_2019#Features https://en.wikipedia.org/wiki/Windows_Server_2019#Features * 2022: https://en.wikipedia.org/wiki/Windows_Server_2022#Features https://en.wikipedia.org/wiki/Windows_Server_2022#Features * 11: https://en.wikipedia.org/wiki/Features_new_to_Windows_11 https://en.wikipedia.org/wiki/Features_new_to_Windows_11 * 2025: https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025 https://learn.microsoft.com/en-us/windows-server/get-started... Obviously some of this will be "fluff" and that's up to your own personal definitions, but to act like there haven't been significant changes in every major revision is just nonsense.
throwaway2037 2y ago
This claim about SQL Server: Is it due to disk access being slower from NT kernel compared to Linux kernel?
- stackskipton 2y ago
  It's just easier for everyone involved (outside Windows GUI clicker admins) if it runs on Linux. Containerization is easier, configuration is easier and operating system is much more robust.
  - psd1 2y ago
    Operating system can be more robust, depending on admin skill. Let idiots configure and operate your rhel and you may not get those five nines. There are costs to it, in the form of architectural baggage and slower iteration, but what windows brings to the table is a deck swept mostly clear of footguns. That can give you a different form of robustness.
- marcosdumay 2y ago
  There's something very wrong with Windows disk access, you can see it easily by trying to run a Windows desktop with rotating disks. But SQL Server is in the unique position of being able to optimize Windows for their own needs. So they shouldn't have this kind of problem.
  - devbent 2y ago
    The file system is almost 30 years old. When NTFS came out it was way better than anything on Linux. Heck even in 2006 NTFS was better. But Linux keeps getting new file systems while Windows keeps NTFS.
    - marcosdumay 2y ago
      AFAIK, NTFS is a perfectly ok design. But the Windows file system never performed well. This is probably not for architectural reasons. And no, it didn't perform better at NT4, XP, or Win7 times.
mosburger 2y ago
> SQL Server team continues to push hard for Linux compatibility with every release. It's kinda funny that the DB that was once a fork of Sybase that was ported to Windows is trying to make its way back to Unix.

benfortuna 2y ago

Keep in mind they don't just allow any old code to execute in the kernel. They do have rigorous tests (WHQL), it's just Crowdstrike decided that was too burdensome for their frequent updates, and decided to inject code from config files (thus bypassing the control). The fault here is entirely with Crowdstrike.

capitainenemo 2y ago
Is there any evidence that the config files had arbitrary code in them? The only analysis I'd seen so far indicated a parsing error loading a viral signature database that was routinely updated, but in this case was full of garbage data.
- benfortuna 2y ago
  Perhaps not verified, but some smart people do have convincing arguments: https://youtu.be/wAzEJxOo1ts?si=UNNxAN27VV1E6mcP&t=505 https://youtu.be/wAzEJxOo1ts?si=UNNxAN27VV1E6mcP&t=505
  - capitainenemo 2y ago
    Any article/blog/text-that-can-be-read?
    - alecco 2y ago
      Don't bother. He just repeats a tweet saying a null+offset dereference and also the speculation of that null picked from the sys file.
remram 2y ago
How rigorous are the tests if faulty data can brick the machine?
- dwattttt 2y ago
  Not rigorous enough to have detected this flaw in the kernel sensor, although effectively any bug in this situation (an AV driver) can brick a machine. I imagine WHQL isn't able to find every possible bug in a driver you submit to them, they're not your QA team.