Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBPF on Windows

github.com

Post reply on HN
Print view View original

141–150 of 169 posts

Re: eBPF on Windows

#141

Post by jiggawatts »

pjmlp wrote: post #135
jiggawatts wrote: post #134

Earlier quoted context omitted.

So you're saying that Linux developers on Macs are now Microsoft's target market? Not Windows developers on Windows?

Basically it feels like going after the SV crowd coding with macs on starbucks.

It feels like that Blizzard developer Wyatt Cheng that got on stage and asked the PC gamer crowd: "Do you guys not have phones?" https://www.youtube.com/watch?v=n5QRgpjfarY

The Windows Terminal guys are similar. "Do you have any plans at all to make this work for users of Windows?" "No."

Re: eBPF on Windows

#142

Post by GordonS »

dataflow wrote: post #136
GordonS wrote: post #49

Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microso…

If all you want is user-mode tracing , there's ETW. Where you run into problems is that it doesn't let you block on calls, etc.

I do need to block on calls. I also need the process and user that made the change, and ETW doesn't provide those (to get them myself would require blocking).

Re: eBPF on Windows

#143

Post by GordonS »

Genbox wrote: post #139
GordonS wrote: post #49

Wow, I'm really stoked to see this! This could be a game-changer for the infosec community in particular - now, if you want to get into internals, such as tracing file system and registry calls, you've got to write drivers. And drivers are very tricky to write, and it's very easy to miss corner cases - which can result in the dreaded BSOD. Plus, drivers need to go through a verification and signing process by Microso…

Sysinternal's Process Monitor does that from a process perspective: https://docs.microsoft.com/en-us/sysinternals/downloads/proc... There is also System Monitor which logs the events to EventLog: https://docs.microsoft.com/en-us/sysinternals/downloads/sysm... Are those not enough?

Process Monitor is a great utility, but I need programmatic access to this information.

SysMon is a great tool, but the license prevents distribution (such as bundling with an installer) - users must download it from Microsoft.

Re: eBPF on Windows

#144

Post by encryptluks2 »

jhomedall wrote: post #118
encryptluks2 wrote: post #81

Earlier quoted context omitted.

Try it out... install Ubuntu using WSL2. Install docker using apt-get. See that it doesn't work without the Docker Desktop install for Windows and a special integration. Try running podman or other container-based solutions and see that they don't work.

Having followed the instructions from https://docs.docker.com/engine/install/ubuntu/ , I was able to get this working fine. This is without Docker Desktop installed. It probably would have also worked with the version from distro repository. zed@ZED-PC:~$ sudo service docker start * Starting Docker: docker [ OK ] zed@ZED-PC:~$ sudo docker run hello-world Unable to find image 'hello-world:latest' locally latest: Pulli…

Are you even on Windows? This is with WSL 2, as you can systemd doesn't work as expected in WSL2. This is a known issue. If systemd is working for you, then you are doing something magic:

  sudo systemctl start docker
  [sudo] password for u3332:
  System has not been booted with systemd as init system (PID 
  1). Can't operate.
  Failed to connect to bus: Host is down
https://stackoverflow.com/questions/55579342/why-systemd-is-...

Re: eBPF on Windows

#145

Post by pjmlp »

jiggawatts wrote: post #141
pjmlp wrote: post #135

Earlier quoted context omitted.

Basically it feels like going after the SV crowd coding with macs on starbucks.

It feels like that Blizzard developer Wyatt Cheng that got on stage and asked the PC gamer crowd: "Do you guys not have phones?" https://www.youtube.com/watch?v=n5QRgpjfarY The Windows Terminal guys are similar. "Do you have any plans at all to make this work for users of Windows?" "No."

I feel your pain, what used to be Visual Studio wizards are now CLI tools.

With luck you need to install VSCode and there is an extension to call said CLI.

Who needs VS designers or Blend for Windows UI development? Just recompile and run WinUI applications.

I really don't get it.

Re: eBPF on Windows

#146

Post by encryptluks2 »

garethrowlands wrote: post #93
encryptluks2 wrote: post #83

Earlier quoted context omitted.

> define terrible. Compared to what ? Terrible = significantly worse than a native Linux distro that doesn't use a file system integration layer. > A very strong statement. Do you have any proof perhaps ? Just experience working in the industry.

> worse than a native Linux distro that doesn't use a file system integration layer What filesystem integration layer?

https://docs.microsoft.com/en-us/windows/wsl/compare-version...

> We recommend against working across operating systems with your files

https://nelsonslog.wordpress.com/2019/06/01/wsl-access-to-li...

Re: eBPF on Windows

#147

Post by kwdc »

EvanAnderson wrote: post #133
corty wrote: post #129

Earlier quoted context omitted.

Group policy "automation" is painful and inconsistent. Parts are only applied on user login. Parts only on reboot. Parts instantly. Hard to impossible to know which is which. And no way to log off users or reboot machines via group policy, so you need remote logins anyways.

I'd argue it's just being familiar with the tools. I'm biased, no doubt. Windows sysadmin work has paid the lion's share of my bills since the late 90s. I've been using Group Policy heavily since 1999 (during the Windows 2000 beta), so I'm used to knowing what applies when. Being familiar with which client-side extensions (CSEs) do which processing helps. The documentation for Microsoft's own functionality is reasona…

Re: rebooting is easy

Full agreement. We were remotely powering on/off hundreds of machines with a single command line. Then just a web page because we needed non-IT people doing it on regular basis.

We used to change wallpapers of certain groups of machines on a daily or even hourly basis due to special events. Do people really think we remotely logged into each one? Or manually remoted each one? Hmmm.

Next someone will be saying its impossible to get the event logs from each machine... truly bizarre. (Yes you can, and we did, even from client machines if a machine had developed "quirks")

Again, these complaints are just strange. Its as if they weren't using their infrastructure.

None of this is any kind of wizardry. I'd expect any linux or windows admin to know the tools required.

Re: eBPF on Windows

#148

Post by saagarjha »

tptacek wrote: post #35
the_only_law wrote: post #24

I admittedly have only an extremely cursory knowledge of these sort of technologies, but how does eBPF compare to NDIS filters and WFP filters? Biggest reason I could imagine for this is easier portability of existing eBPF applications.

You can do a lot more in NDIS and probably more in WFP than you can in eBPF, if only because eBPF has strict limits on the kinds of loops you can express (they have to be verifiably bounded). Packet-processing BPF programs are tightly bound to Linux kernel APIs, many of which won't be ported here, so I think write-once-run-anywhere is unlikely to be an attribute of this. Importantly: eBPF has at this point not much t…

…where?

Re: eBPF on Windows

#149

Post by staticassertion »

hinkley wrote: post #132
staticassertion wrote: post #25

Earlier quoted context omitted.

No, this would just be embrace, they have not extended the ebpf capabilities. It would be "extend" if there were one way comparability, which doesn't seem to be the case.

If they patent ways to analyze more complex eBPF programs that would be extend in a very literal sense of the term.

I don't get what you're trying to convey here. Yes, there are hypothetical situations we could talk about?

Re: eBPF on Windows

#150

Post by Liquid_Fire »

encryptluks2 wrote: post #144
jhomedall wrote: post #118

Earlier quoted context omitted.

Having followed the instructions from https://docs.docker.com/engine/install/ubuntu/ , I was able to get this working fine. This is without Docker Desktop installed. It probably would have also worked with the version from distro repository. zed@ZED-PC:~$ sudo service docker start * Starting Docker: docker [ OK ] zed@ZED-PC:~$ sudo docker run hello-world Unable to find image 'hello-world:latest' locally latest: Pulli…

Are you even on Windows? This is with WSL 2, as you can systemd doesn't work as expected in WSL2. This is a known issue. If systemd is working for you, then you are doing something magic: sudo systemctl start docker [sudo] password for u3332: System has not been booted with systemd as init system (PID 1). Can't operate. Failed to connect to bus: Host is down https://stackoverflow.com/questions/55579342/why-systemd-is…

If you run the Docker daemon manually, it works just fine. I'm running a container on it right now.

It's not a problem with Docker on WSL 2, but a problem with the way WSL uses its own init system instead of systemd, while some Ubuntu packages are packaged for a systemd system.

Post reply on HN