Live data from Hacker News

eBPF on Windows

github.com

81–90 of 169 posts

Re: eBPF on Windows

#81

Earlier quoted context omitted.

Docker containers don't run in WSL.

They do in WSL2, as I understand it.

Try it out... install Ubuntu using WSL2. Install docker using apt-get. See that it doesn't work without the Docker Desktop install for Windows and a special integration. Try running podman or other container-based solutions and see that they don't work.

Re: eBPF on Windows

#82
post #54

Here is a recent comment from Dropbox engineers about the state of tracing tooling on Linux compared to Windows: https://dropbox.tech/infrastructure/boosting-dropbox-upload-... Is their assessment correct? If so, how comes that we got DTrace in 2019 and now eBPF ported to Windows? Are they trying to consolidate all tooling into one platform?

ETW (What netsh trace in the post uses underneath) has been around for 20+ years in Windows and is extremely powerful. However, Microsoft has always neglected the usability side of it. It's a bitch to set up and hard to interpret. Documentation is there, but scattered and hard to find easily.

Most people here have probably seen Bruce Dawson's performance analysis and debugging posts. WPA/WPR are probably the only user-friendly (ish) ETW applications and even those are not that easy to use.

So yeah, Windows has had powerful tracing and inspection tools for a while, but few people know how to use them well.

As far as why they are doing DTrace and eBPF, I think both of those fill some holes that ETW doesn't. Mainly dynamic tracing and instrumentation, but I am sure there are other advantages I am not thinking of as well.

They could have come up with another hopelessly complicated Microsoftie framework to do the same things, but it's probably a good thing that they didn't.

Re: eBPF on Windows

#83

Earlier quoted context omitted.

Compiling on WSL2 would have terrible performance. WSL2 is just there to try to entice companies to say their developers shouldn't need to move to Linux or Mac. No one is seriously developing in WSL.

> Compiling on WSL2 would have terrible performance. define terrible. Compared to what ? > No one is seriously developing in WSL. A very strong statement. Do you have any proof perhaps ?

> define terrible. Compared to what ?

Terrible = significantly worse than a native Linux distro that doesn't use a file system integration layer.

> A very strong statement. Do you have any proof perhaps ?

Just experience working in the industry.

Re: eBPF on Windows

#84
post #37
post #18

Earlier quoted context omitted.

I seem to recall authorized_keys works as expected; it goes into %HOME%\.ssh\authorized_keys (I'm not sure/can't recall if there are some similar permission requirements). Anyway, that's eg: c:\users\mcgyver\.ssh\authorized_keys And ssh needs a restart. That said, windows remote management is traditionally via WMI, not powershell. But PS has come a long way, and ssh is a sane transport. And it can function as a tunne…

If you're a member of the administrators group, by default it uses something out of C:\ProgramData instead. https://docs.microsoft.com/en-us/windows-server/administrati...

But of course, you're not running as Administrator, right? That's why we have runas... :)

Re: eBPF on Windows

#85
post #49

Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microso…

Everything you described is already available on Windows in userland via filters (FileSystemWatcher/ReadDirectoryChangesW, RegNotifyChangeKeyValue, et al). Obviously you can only monitor whatever lives in your security context.

eBPF looks cool since it is a VM, that could have access to more kernel structures (network?), but solving the issues you described is largely a solved problem on the platform.

Re: eBPF on Windows

#86

Earlier quoted context omitted.

were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior

sed/grep/awk have nothing to do with bash tho and you can run them equally easy on Windows (cinst sed grep awk) if you like outdated reg ex.

yes they're not bash but they're an integral part of bash scripts pipe processing

Re: eBPF on Windows

#87

Earlier quoted context omitted.

were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior

> Sure, although, you know, my team – we all have deep UNIX backgrounds, before getting into NT, I was a UNIX development manager at Digital [Equipment Corporation], … worked on Ultrix, System 5. https://www.networkworld.com/article/3110744/linuxcon-qa-wit...

oh wow, I had no idea

thanks for the link

Re: eBPF on Windows

#88

Earlier quoted context omitted.

were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior

I don't think I want to compare them - I dislike them both! One is too basic and cryptic, the other one is overly complex for a shell, and in the end, I want to use neither. I'm not sure what the ideal shell would look like though. Maybe an actual (simple and expressive) programming language with a way to 'lift' statements ?

oh my bad then, and the quest for an ideal shell / text user interface is a nice one. between lispy repls, to notebooks .. I guess there's a better solution that is both concise and fun yet not brittle.

Re: eBPF on Windows

#89

Pretty cool, but let's not fool ourselves. Recall history or why Microsoft is doing this. This is a long-term strategy. https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

Has Microsoft been doing a lot of embracing, extending, and extinguishing lately? I guess Typescript kind of embraces and extends Javascript, but I think every frontend engineer will be doing a happy dance if they manage to extinguish it. Not quite 1990s Microsoft's approach.

Re: eBPF on Windows

#90

Earlier quoted context omitted.

sed/grep/awk have nothing to do with bash tho and you can run them equally easy on Windows (cinst sed grep awk) if you like outdated reg ex.

yes they're not bash but they're an integral part of bash scripts pipe processing

They are "integral" only because shell is lacking those functions.

On some places tools are not there (docker image for example).

Some people complain about size of the dotNet runtime, but if you install all those tools bash "needs" for comfy usage, you can equally easy install dotNet.

Post reply on HN