4 ms·
There are solutions in monolithic kernels for writing safe kernel space code now too. eBPF has been a thing for a while now (https://ebpf.io/what-is-ebpf/ https
by c0n5pir4cy 2y ago
There are solutions in monolithic kernels for writing safe kernel space code now too. eBPF has been a thing for a while now (https://ebpf.io/what-is-ebpf/ https://ebpf.io/what-is-ebpf/) and while it might not be as safe as microkernel it's available now and it works on both Windows and Linux.
I think a big question is why are things like CrowdStrike still written in raw C++ Kernel code? Is it the limitations of eBPF? Is it stagnations of the tech stack at these companies?
- sudhirc 2y agoThanks for the pointer. I will give it a read later on. If I understood correctly, eBPF is a guard rail for writing relatively bug free code. But it will still run in the processor[0] ring 0 which essentially is the same level as the kernel itself. [0] https://en.wikipedia.org/wiki/Protection_ring https://en.wikipedia.org/wiki/Protection_ring
- fastest963 2y agoCrowdStrike uses eBPF on Linux but Windows doesn't support eBPF.
- noisem4ker 2y agoPerhaps it's not sufficiently complete yet for CrowdStrike to use it, but Microsoft has been developing eBPF support for Windows since 2019: https://github.com/microsoft/ebpf-for-windows/ https://github.com/microsoft/ebpf-for-windows/