Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBPF on Windows

github.com

Post reply on HN
Print view View original

41–50 of 169 posts

Re: eBPF on Windows

#41

Post by tptacek »

bostonsre wrote: post #36
PoignardAzur wrote: post #22

Earlier quoted context omitted.

What?

BPF or berkely packet filter was written to be a faster replacement of tcpdump. People saw that it was pretty neat and started using it for non-tcp dump like stuff and it became extended BPF/eBPF. I would guess that running eBPF on Windows would be a lot slower, but it would be interesting to see a performance comparison.

Point of order: BPF wasn't written simply for tcpdump; it's part of a line of research on using PL runtimes to configure and operate networking stacks; so, right after McCanne's BPF paper, you get MPF, which is proposed to do all of demux for Mach.

Re: eBPF on Windows

#42

Post by pjc50 »

jaywalk wrote: post #21
etaioinshrdlu wrote: post #3

Earlier quoted context omitted.

I recently spun up a Windows EC2 server instance in aws, running the latest Windows, and was not impressed. The entire system is not very well set up for operation via SSH. SSH is not even enabled by default on ec2. You have to Remote Desktop in, run a bunch of commands to enable it, and even then I could never figure out how to get authorized_keys to work. Once you have SSH running, you can run commands via command…

I like Windows Server more than Linux. I administer both of them, although I am more familiar with Windows Server which definitely plays a big part in my preference. But I think that's going to be the biggest part of anyone's preference. Everything you complain about Windows Server not supporting is actually supported, but it was your unfamiliarity that was ultimately the issue. "Linux guy who is unfamiliar with Wind…

> Everything you complain about Windows Server not supporting is actually supported, but it was your unfamiliarity that was ultimately the issue.

Funny, I've seen people saying exactly that when newbies bounce off some aspect of Linux, and in both cases it's a usability failure.

Discoverability of this stuff on Windows is terrible. Things like powershell remoting exist but getting them working between two random machines is opaque. Yes, some of it gets easier in a domain, and that's one of the big Windows wins (since the NIS/YP era), but domains are an extremely premium feature.

Re: eBPF on Windows

#43

Post by pjmlp »

coolspot wrote: post #2

And that is, kids, how MS Windows piece-by-piece was slowly transformed into a Linux distro.

On the contrary, that is how Microsoft fixes the big mistake of not having kept POSIX subsytem around and improved it throughout the last 25 years.

Re: eBPF on Windows

#44

Post by agumonkey »

etaioinshrdlu wrote: post #3
coolspot wrote: post #2

And that is, kids, how MS Windows piece-by-piece was slowly transformed into a Linux distro.

I recently spun up a Windows EC2 server instance in aws, running the latest Windows, and was not impressed. The entire system is not very well set up for operation via SSH. SSH is not even enabled by default on ec2. You have to Remote Desktop in, run a bunch of commands to enable it, and even then I could never figure out how to get authorized_keys to work. Once you have SSH running, you can run commands via command…

> Powershell is apparently pretty modern and well designed, but it's quite confusing if you're used to Unix.

bash is pretty confusing eve if you're used to unix

-- Greg's

Re: eBPF on Windows

#45

Post by mhh__ »

bostonsre wrote: post #6

I wonder what kind of performance this gets when compared with running eBPF since eBPF was written with performance in mind from the start.

Hence, the reason why eBPF has been referred to in the past as a Spectre-accelerator

Re: eBPF on Windows

#46

Post by majkinetor »

pjc50 wrote: post #42
jaywalk wrote: post #21

Earlier quoted context omitted.

I like Windows Server more than Linux. I administer both of them, although I am more familiar with Windows Server which definitely plays a big part in my preference. But I think that's going to be the biggest part of anyone's preference. Everything you complain about Windows Server not supporting is actually supported, but it was your unfamiliarity that was ultimately the issue. "Linux guy who is unfamiliar with Wind…

> Everything you complain about Windows Server not supporting is actually supported, but it was your unfamiliarity that was ultimately the issue. Funny, I've seen people saying exactly that when newbies bounce off some aspect of Linux, and in both cases it's a usability failure. Discoverability of this stuff on Windows is terrible . Things like powershell remoting exist but getting them working between two random mac…

Its trivial without domain TBH.

If on workgroup, you just have to have the same user name on different machine and it works like in domain.

> Discoverability of this stuff on Windows is terrible

Meh... matter of taste and adequate Windows social skills, not a fact.

Re: eBPF on Windows

#47

Post by encryptluks2 »

cptskippy wrote: post #11
encryptluks2 wrote: post #5

Earlier quoted context omitted.

They implement Linux functionality enough to suck at it and then the Windows users that try it thinks it is Linux that sucks and not Windows.

The Linux functionality is intended to allow Windows developers to develop for Linux and deploy to Linux.

Compiling on WSL2 would have terrible performance. WSL2 is just there to try to entice companies to say their developers shouldn't need to move to Linux or Mac. No one is seriously developing in WSL.

Re: eBPF on Windows

#48

Post by tptacek »

A fun detail of this work is that it uses a formal-methods-based verifier (designed outside of Microsoft) that accepts a wider range of programs than does the Linux verifier, which is itself kind of nightmare fuel.

https://vbpf.github.io/assets/prevail-paper.pdf

The verifier in this paper also has some biting limitations; for instance, you can't resize a packet in it, because they don't account for pointer invalidation. I wonder whether they've since implemented these verifier features, since they'd be problematic for compatibility otherwise.

Additionally, the PREVAIL paper explicitly doesn't verify program termination, which is kind of a dealbreaker for kernel BPF.

Re: eBPF on Windows

#49

Post by GordonS »

Wow, I'm really stoked to see this!

This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microsoft.

Having access to that capability from user-mode, without having to write drivers... that would be amazing.

Re: eBPF on Windows

#50

Post by majkinetor »

jaywalk wrote: post #21
etaioinshrdlu wrote: post #3

Earlier quoted context omitted.

I recently spun up a Windows EC2 server instance in aws, running the latest Windows, and was not impressed. The entire system is not very well set up for operation via SSH. SSH is not even enabled by default on ec2. You have to Remote Desktop in, run a bunch of commands to enable it, and even then I could never figure out how to get authorized_keys to work. Once you have SSH running, you can run commands via command…

I like Windows Server more than Linux. I administer both of them, although I am more familiar with Windows Server which definitely plays a big part in my preference. But I think that's going to be the biggest part of anyone's preference. Everything you complain about Windows Server not supporting is actually supported, but it was your unfamiliarity that was ultimately the issue. "Linux guy who is unfamiliar with Wind…

This. RTFM
Post reply on HN