Live data from Hacker News

eBPF on Windows

github.com

71–80 of 169 posts

Re: eBPF on Windows

#71
post #69

Earlier quoted context omitted.

Lets limit GUI then :)

Ha, that's actually what I'm complaining about. So many things that can only be done via CLI and there's no way to even know they're possible without crawling through documentation or (more often) finding somebody's blog post or a StackOverflow answer.

PowerShell CLI is totally discoverable tho.

Re: eBPF on Windows

#72

Earlier quoted context omitted.

Compiling on WSL2 would have terrible performance. WSL2 is just there to try to entice companies to say their developers shouldn't need to move to Linux or Mac. No one is seriously developing in WSL.

It's not really targeted at compiling either. Think line of business apps on web technology like .NET Core, PHP, Python, etc... With WSL you can setup some docker containers or do some orchestration with Kubernetes and push it off to the cloud with minimal effort. If you really want a full Linux environment you can spin up a VM in Hyper-V. WSL just makes it easier to do things where a VM is a hassle.

Docker containers don't run in WSL.

Re: eBPF on Windows

#73
post #38
post #30

Is there any analogue of seccomp in windows that can be used with BPF?

Windows already has a native system call filter, doesn't it?

I don't think so? I actually looked for such functionality recently and couldn't find anything. Kaspersky uses a hypervisor to hook syscalls[0] in order to provide such functionality. There's also DTrace for Windows[1], but that requires being enabled through bcdedit which is a bit... meh.

[0]: https://github.com/iPower/KasperskyHook

[1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

Re: eBPF on Windows

#74
post #49

Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microso…

It is really great to see that eBPF is causing an industry wide change instead of just a Linux one!

Re: eBPF on Windows

#75

Earlier quoted context omitted.

I recently spun up a Windows EC2 server instance in aws, running the latest Windows, and was not impressed. The entire system is not very well set up for operation via SSH. SSH is not even enabled by default on ec2. You have to Remote Desktop in, run a bunch of commands to enable it, and even then I could never figure out how to get authorized_keys to work. Once you have SSH running, you can run commands via command…

MSIs, if put together well, easily install silently from the command line. msiexec /qn /i msi-name.msi Edit (now that I have more time): All the tooling to make Windows command-line manageable is there "out of the box". In a former "life" I staged a Windows Server 2008 R2 install that was remotely manageable with SSH (using a third-party SSH server) "out of the box". Similar to a "kickstart" w/ the Anaconda installer…

and /norestart too

Re: eBPF on Windows

#76

Earlier quoted context omitted.

It's not really targeted at compiling either. Think line of business apps on web technology like .NET Core, PHP, Python, etc... With WSL you can setup some docker containers or do some orchestration with Kubernetes and push it off to the cloud with minimal effort. If you really want a full Linux environment you can spin up a VM in Hyper-V. WSL just makes it easier to do things where a VM is a hassle.

Docker containers don't run in WSL.

They do in WSL2, as I understand it.

Re: eBPF on Windows

#77

Earlier quoted context omitted.

Bash is simply outdated. It grown organically and thats what you got. Now you have zillion scripts and situation is even worst then with cobol. PowerShell was made by Unix people after 2+ decades of bash experience. It solved hundreds of things. Yet people complain it didn't solve few or it takes a bit more to load (no, verbosity = RTFM). You can't ever please I guess.

were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior

I don't think I want to compare them - I dislike them both! One is too basic and cryptic, the other one is overly complex for a shell, and in the end, I want to use neither.

I'm not sure what the ideal shell would look like though. Maybe an actual (simple and expressive) programming language with a way to 'lift' statements ?

Re: eBPF on Windows

#78

Earlier quoted context omitted.

It's not really targeted at compiling either. Think line of business apps on web technology like .NET Core, PHP, Python, etc... With WSL you can setup some docker containers or do some orchestration with Kubernetes and push it off to the cloud with minimal effort. If you really want a full Linux environment you can spin up a VM in Hyper-V. WSL just makes it easier to do things where a VM is a hassle.

Docker containers don't run in WSL.

Sure they do.

https://i.imgur.com/TqW6Ola.png

Re: eBPF on Windows

#80

Earlier quoted context omitted.

It's not really targeted at compiling either. Think line of business apps on web technology like .NET Core, PHP, Python, etc... With WSL you can setup some docker containers or do some orchestration with Kubernetes and push it off to the cloud with minimal effort. If you really want a full Linux environment you can spin up a VM in Hyper-V. WSL just makes it easier to do things where a VM is a hassle.

Docker containers don't run in WSL.

You still have to install Docker Desktop and enable the integration. You can't simply install docker in your WSL2 distro and use it.
Post reply on HN