Earlier quoted context omitted.
Docker containers don't run in WSL.
They do in WSL2, as I understand it.
eBPF on Windows
81–90 of 169 posts
Re: eBPF on Windows
#82Here is a recent comment from Dropbox engineers about the state of tracing tooling on Linux compared to Windows: https://dropbox.tech/infrastructure/boosting-dropbox-upload-... Is their assessment correct? If so, how comes that we got DTrace in 2019 and now eBPF ported to Windows? Are they trying to consolidate all tooling into one platform?
Most people here have probably seen Bruce Dawson's performance analysis and debugging posts. WPA/WPR are probably the only user-friendly (ish) ETW applications and even those are not that easy to use.
So yeah, Windows has had powerful tracing and inspection tools for a while, but few people know how to use them well.
As far as why they are doing DTrace and eBPF, I think both of those fill some holes that ETW doesn't. Mainly dynamic tracing and instrumentation, but I am sure there are other advantages I am not thinking of as well.
They could have come up with another hopelessly complicated Microsoftie framework to do the same things, but it's probably a good thing that they didn't.
Re: eBPF on Windows
#83Earlier quoted context omitted.
Compiling on WSL2 would have terrible performance. WSL2 is just there to try to entice companies to say their developers shouldn't need to move to Linux or Mac. No one is seriously developing in WSL.
> Compiling on WSL2 would have terrible performance. define terrible. Compared to what ? > No one is seriously developing in WSL. A very strong statement. Do you have any proof perhaps ?
Terrible = significantly worse than a native Linux distro that doesn't use a file system integration layer.
> A very strong statement. Do you have any proof perhaps ?
Just experience working in the industry.
Re: eBPF on Windows
#84Earlier quoted context omitted.
I seem to recall authorized_keys works as expected; it goes into %HOME%\.ssh\authorized_keys (I'm not sure/can't recall if there are some similar permission requirements). Anyway, that's eg: c:\users\mcgyver\.ssh\authorized_keys And ssh needs a restart. That said, windows remote management is traditionally via WMI, not powershell. But PS has come a long way, and ssh is a sane transport. And it can function as a tunne…
If you're a member of the administrators group, by default it uses something out of C:\ProgramData instead. https://docs.microsoft.com/en-us/windows-server/administrati...
Re: eBPF on Windows
#85Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microso…
eBPF looks cool since it is a VM, that could have access to more kernel structures (network?), but solving the issues you described is largely a solved problem on the platform.
Re: eBPF on Windows
#86Earlier quoted context omitted.
were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior
sed/grep/awk have nothing to do with bash tho and you can run them equally easy on Windows (cinst sed grep awk) if you like outdated reg ex.
Re: eBPF on Windows
#87Earlier quoted context omitted.
were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior
> Sure, although, you know, my team – we all have deep UNIX backgrounds, before getting into NT, I was a UNIX development manager at Digital [Equipment Corporation], … worked on Ultrix, System 5. https://www.networkworld.com/article/3110744/linuxcon-qa-wit...
thanks for the link
Re: eBPF on Windows
#88Earlier quoted context omitted.
were powershell designers from the unix world ? I didn't know that I don't mind bash warts, history is what it is, I don't sell powershell .. but someone saying powershell is confusing has serious jaws. powershell is really nice and only if you fancy sed/grep everything then you'll consider bash* superior
I don't think I want to compare them - I dislike them both! One is too basic and cryptic, the other one is overly complex for a shell, and in the end, I want to use neither. I'm not sure what the ideal shell would look like though. Maybe an actual (simple and expressive) programming language with a way to 'lift' statements ?
Re: eBPF on Windows
#89Pretty cool, but let's not fool ourselves. Recall history or why Microsoft is doing this. This is a long-term strategy. https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
Re: eBPF on Windows
#90Earlier quoted context omitted.
sed/grep/awk have nothing to do with bash tho and you can run them equally easy on Windows (cinst sed grep awk) if you like outdated reg ex.
yes they're not bash but they're an integral part of bash scripts pipe processing
On some places tools are not there (docker image for example).
Some people complain about size of the dotNet runtime, but if you install all those tools bash "needs" for comfy usage, you can equally easy install dotNet.