Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No More Blue Fridays

brendangregg.com

Post reply on HN
Print view View original

191–200 of 282 posts

Re: No More Blue Fridays

#191

Post by recursive »

queuebert wrote: post #167
kevincox wrote: post #88

Earlier quoted context omitted.

They aren't over windows. They continue to be incredibly interested in and actively developing how much money they can suck from their users. Especially via various forms of ads. But yeah, kernel features are few and far between.

I believe the term you are looking for is "rent seeking". Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? (I'm being generous with XP, because actually 95 was already mostly internet ready.) Yet how many times have many of us paid for a Windows license on a new computer or because the old version stopped getting updates?

> what new functionality does Windows 11 actually have that Windows XP didn't have? (

Off the top of my head, built-in bluetooth support, an OS-level volume mixer, and more support for a wider variety of class-compliant devices. I'm sure there are a lot more, and if you actually care about the answer, I don't think it would be hard to find.

Re: No More Blue Fridays

#192

Post by loeg »

fwip wrote: post #186
jkrejcha wrote: post #156

Earlier quoted context omitted.

Adding on (and it's not terribly relevant to eBPF), it's also worth noting that there are trivial programs you can prove DON'T halt. A trivial example[1]: int main() { while (true) {} int x = foo(); return x; } This program trivially runs forever[2], and indeed many static code analyzers will point out that everything after the `while (true) {}` line is unreachable. I feel like the halting problem is incredibly widel…

EDIT: I am incorrect, please ignore. (Original text below, for posterity). Nit: In many languages, doesn't this depend on what foo() does? e.g: foo() { exit(0); }

No? The foo() invocation is never reached because the while loop never terminates.

Re: No More Blue Fridays

#193

Post by Agingcoder »

Xunjin wrote: post #100
philistine wrote: post #99

Earlier quoted context omitted.

Apple took the lead on this front. It has closed easy access to the kernel by apps, and made a list of APIs to try and replace the lost functionality. Anyone maintaining a kernel module on macOS is stuck in the past. Of course, the target area of macOS is much smaller than Windows, but it is absolutely possible to kick all code, malware and parasitic security services alike, from accessing the kernel. The safest kern…

> The safest kernel is the one that cannot be touched at runtime. Can you expand what you mean here? Because depending on the application you are running, you will need at least talk with some APIs to get privileged access?

Being allowed to talk to the kernel to get info and running with the same privileges ( basically being able to read / write any memory ) is different.

Re: No More Blue Fridays

#195

Post by tgtweak »

Even if Microsoft rolls out eBPF and mainstreams it - it will be years before everything is ported over and it still won't address legacy windows versions (which appear to be a good chunk of what was impacted).

It's a move in the right direction but it probably won't fully mitigate issues like this for another 5+ years.

Re: No More Blue Fridays

#197

Post by sunnyps »

SoftTalker wrote: post #134
aksdlf wrote: post #35

Earlier quoted context omitted.

I'm glad to hear that Meta and Google code is "rigorous". I'd prefer INRIA, universities that fund theorem provers, industries where correctness matters like aerospace or semiconductors.

Also that lines of code is a proxy for rigor, something new I learned today. /s

I think they mean that the code base is small enough to be audited thoroughly. Maybe they should reword it to be clearer.

Re: No More Blue Fridays

#198

Post by titzer »

WebAssembly is a better choice for sandboxing kernel code. It has a full formal specification with a mechanized proof of type safety, many high-performance implementations, broad toolchain support, is targetable from many languages, and a capability security model.

Re: No More Blue Fridays

#199

Post by fwip »

loeg wrote: post #192
fwip wrote: post #186

Earlier quoted context omitted.

EDIT: I am incorrect, please ignore. (Original text below, for posterity). Nit: In many languages, doesn't this depend on what foo() does? e.g: foo() { exit(0); }

No? The foo() invocation is never reached because the while loop never terminates.

Apologies; I misread the function call as being inside the loop.

Re: No More Blue Fridays

#200

Post by hello_moto »

whynotminot wrote: post #180
hello_moto wrote: post #149

Earlier quoted context omitted.

Let's walk this through: Canary deployment to Windows machines. If those Windows machines got hit with BSOD, they will go offline. How do you determine if they go offline because of Canary or because of regular maintenance by the customer's IT cycle? You can guess, but you cannot be 100% sure. What if the targeted canary deployments are Employees desktops that are OFFLINE during the time of rollout? >I’m out of the l…

> You can guess, but you cannot be 100% sure. I worked in the cyber security space for a decent chunk of my career, and the most frustrating part was cyber security engineers thinking their problems were unique and being completely unaware of the lessons software engineering teams have already learned. Yes, you need to tune your canary deployment groups to be large and diverse enough to give a reliable indicator of d…

>if you follow industry best practices for software deployment, this is already something that should be considered. This is a relatively solved problem -- this is not new.

You have to ask the customer if they're okay with that citing "our software might failed and brick your machine".

I'd like to see any Sales and Marketing folks say that ;)

> I think that question is being asked right now by every company using Crowdstrike — what vendors are actually doing proper release engineering and how fast can we switch to them so that this never happens to us again?

Uber valid question and this BSOD incident might be a turning point for customers to pay up more for their IT infrastructure.

It's like: previously Cybersecurity vendors are shy to ask customers to setup Canary systems because that's just "one-more-thing-to-do". After BSOD: customers will smarten up and do it without being asked and to the point where they would ask Vendors to _support_ that type of deployment (unless they continue to be cheap and lazy).

Post reply on HN