No More Blue Fridays
brendangregg.com
No More Blue Fridays
1–10 of 282 posts
Re: No More Blue Fridays
#2> In the future, computers will not crash due to bad software updates, even those updates that involve kernel code. In the future, these updates will push eBPF code.
Assuming every security critical system will be on a recent enough kernel to support this...
Re: No More Blue Fridays
#3Does anyone know how far along the eBPF implementation for Windows actually is? In the sense that it could start feasibly replacing existing kernel drivers.
Re: No More Blue Fridays
#4> If your company is paying for commercial software that includes kernel drivers or kernel modules, you can make eBPF a requirement.
Are they saying that device drivers should be written in eBPF?
Or maybe their drivers should expose an eBPF API?
I assume some driver code still needs to reside in the actual kernel.
Re: No More Blue Fridays
#5Is there a reason for the lack of naming+shaming Crowdstrike in this blogpost? Was it to not give them any more publicity, good or bad?
Re: No More Blue Fridays
#6Is there a reason for the lack of naming+shaming Crowdstrike in this blogpost? Was it to not give them any more publicity, good or bad?
If you consider kernel programming to be inherently unsafe, then you would consider this to be inevitable, meaning it's not really the specific company's fault. They were just the unlucky ones.
Re: No More Blue Fridays
#7> In the future, computers will not crash due to bad software updates, even those updates that involve kernel code. In the future, these updates will push eBPF code. Assuming every security critical system will be on a recent enough kernel to support this...
I think with a LTS distribution you should get very far these days when it comes to implementing such sensors.
Re: No More Blue Fridays
#8Is there a reason for the lack of naming+shaming Crowdstrike in this blogpost? Was it to not give them any more publicity, good or bad?
If you consider kernel programming to be inherently unsafe, then you would consider this to be inevitable, meaning it's not really the specific company's fault. They were just the unlucky ones.
Agree, Crowdstrike was an unlucky one, but it is more about the issue in general. If I remember correctly, also others like sysdig user their own kernel modules for collection.
Re: No More Blue Fridays
#9> In the future, computers will not crash due to bad software updates, even those updates that involve kernel code. In the future, these updates will push eBPF code. Assuming every security critical system will be on a recent enough kernel to support this...
And assuming there's no bugs in the BPF code...
Re: No More Blue Fridays
#10Is there a reason for the lack of naming+shaming Crowdstrike in this blogpost? Was it to not give them any more publicity, good or bad?
If you consider kernel programming to be inherently unsafe, then you would consider this to be inevitable, meaning it's not really the specific company's fault. They were just the unlucky ones.
I still hold true that testing even improperly would have caught this before it hit worldwide. But I suppose you are right, that doesn’t help the argument being made here.