3 ms·
Sigh. Guys, eBPF provides more limited access to kernel features. That’s by design. Whatever the platform, the idea with eBPF is to limit kernel access and pro
by bilbo0s 2y ago
Sigh.
Guys, eBPF provides more limited access to kernel features. That’s by design. Whatever the platform, the idea with eBPF is to limit kernel access and provide safe access only where ‘necessary’.
The entire issue is that MS limited access to their kernel. If you want the people who use eBPF, windows developers, to have the same access to kernel features as the providers of eBPF facilities, MS themselves, then you’re effectively giving them kernel access.
There is no such thing as safe full featured kernel access.
- freeopinion 2y agoI personally don't have problems with developers having kernel access. I can't imagine any open source OS fan objecting to this. I do have problems with MS or any other vendor using kernel access unnecessarily. MS Paint should not run in the kernel. Just because you can doesn't mean you should. The question is whether MS or any other vendor could provide the feature set their product enjoys without running in the kernel. If Windows offered anything like eBPF but MS security apps chose to run in-kernel instead of through eBPF, then MS should be forced to give competitors the same kernel access. If MS would play fair and restrict their non-OS teams to userspace they wouldn't have to play fair by providing access to kernelspace. The argument is that it is impossible for MS non-OS teams to play in userspace because MS doesn't provide the APIs to make it possible. It seems that some other OSes might not suffer from this deficiency.