> Knowledge of this isn't widespread however, even security experts I have spoken to that don't have deep kernel development background aren't really aware of h

> Knowledge of this isn't widespread however, even security experts I have spoken to that don't have deep kernel development background aren't really aware of how widespread Netlink is in generic non-network related subsystems. Depends on the scene. This is why my portfolio companies as well as my previous employer when I was a PM and SWE began moving engineering (and even PM) hiring to Israel, CEE, and India. I've noticed a severe degradation in OS, Systems, and Networking knowledge in the US market over the past 15 years. Everyone went gungho into "fullstack" or "backend" and significantly deskilled. > Netlink is pretty awesome It really is. Most security products will use a mix of Netlink and eBPF to gain observability and enforcement capabilities on Linux workloads. > if you have to say run a daemon that manages network device state that now becomes attack surface for other juicy things you can do with Netlink (because once you have CAP_NET_ADMIN everything is up for grabs) Big reason most companies I know of would prevent third party software from being granted CAP_NET_ADMIN