Live data from Hacker News

eBPF – The Future of Networking and Security

cilium.io

11–20 of 38 posts

Re: eBPF – The Future of Networking and Security

#11

The future ought to be capabilities. All this policy scripting stuff is just drudgery make-work that gets us nowhere.

BPF wasn't originally conceived of as a reference monitor or ACL system; in fact, originally, it was believed that operating systems would use BPF-style packet filters to do pretty much all their demuxing.

Re: eBPF – The Future of Networking and Security

#13
post #12
post #7

Disclaimer: I wrote the post. Happy to answer any questions.

First of all, congrats. The tech is great and I hope you'll be able to make a company around it. As for the question: How are you looking to make money?

I'm not going to spam this forum with a marketing pitch so I'll just refer to https://www.isovalent.com/product and add that you can buy a Cilium Enterprise distribution with enterprise specific add-ons from us.

Re: eBPF – The Future of Networking and Security

#14
post #11

The future ought to be capabilities. All this policy scripting stuff is just drudgery make-work that gets us nowhere.

BPF wasn't originally conceived of as a reference monitor or ACL system; in fact, originally, it was believed that operating systems would use BPF-style packet filters to do pretty much all their demuxing.

That's all true. I'm worried about what people will do with this stuff in practice (more rope to hang themselves) not eBPF fundamentally is.

Re: eBPF – The Future of Networking and Security

#15
post #10
post #9

Earlier quoted context omitted.

The shift from BPF to eBPF was less of an evolutionary step as the name might indicate. The overlap with the name BPF is primarily due to the requirement for eBPF to be a superset of BPF in order to avoid having to maintain two virtual machines long-term. This was one of the conditions for eBPF to be merged and in that context, the name eBPF made sense.

Disagree (see sibling post). Classic BPF could have been translated into any virtual machine design they came up with (because classic BPF is incredibly simple). When McCanne came up with the same design in 1998, his team called it "BPF+", for the same reason eBPF is called eBPF --- because it is pretty much an evolution of the earlier idea.

I'm not going to argue with you. You can read up on initial naming and framing in slides of netconf and plumbers conferences as well as LKML archives.

Re: eBPF – The Future of Networking and Security

#16
post #11

The future ought to be capabilities. All this policy scripting stuff is just drudgery make-work that gets us nowhere.

BPF wasn't originally conceived of as a reference monitor or ACL system; in fact, originally, it was believed that operating systems would use BPF-style packet filters to do pretty much all their demuxing.

AFAIK BPF wasn’t conceived as anything security-related, it was just an optimization.

Re: eBPF – The Future of Networking and Security

#18
post #16
post #11

Earlier quoted context omitted.

BPF wasn't originally conceived of as a reference monitor or ACL system; in fact, originally, it was believed that operating systems would use BPF-style packet filters to do pretty much all their demuxing.

AFAIK BPF wasn’t conceived as anything security-related, it was just an optimization.

It was, but it was an optimization over earlier VM-based packet filters, which were definitely not optimizations; they were pursued as elegant system design, not high-performance networking.

Re: eBPF – The Future of Networking and Security

#19
post #11

The future ought to be capabilities. All this policy scripting stuff is just drudgery make-work that gets us nowhere.

BPF wasn't originally conceived of as a reference monitor or ACL system; in fact, originally, it was believed that operating systems would use BPF-style packet filters to do pretty much all their demuxing.

Are you referring to STREAMS? https://en.m.wikipedia.org/wiki/STREAMS

Re: eBPF – The Future of Networking and Security

#20
post #11

Earlier quoted context omitted.

BPF wasn't originally conceived of as a reference monitor or ACL system; in fact, originally, it was believed that operating systems would use BPF-style packet filters to do pretty much all their demuxing.

Are you referring to STREAMS? https://en.m.wikipedia.org/wiki/STREAMS

Not really, though BPF was sort of a design alternative to Solaris/SVR4 STREAMS. If you follow the cites, BPF is really an evolution of CSPF, the CMU-Stanford Packet Filter. (As I understand it! McCanne could show up at any moment and correct me.)
Post reply on HN