Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No More Blue Fridays

brendangregg.com

Post reply on HN
Print view View original

221–230 of 282 posts

Re: No More Blue Fridays

#221

Post by nkozyra »

guipsp wrote: post #110
nkozyra wrote: post #79

I don't do any kernel stuff so I'm out of my element, but doesn't the fact that Crowdstrike & Linux kernel eBPF already caused kernel crashes[1] sort of downplay the rosiness of the state of things? [1]: https://access.redhat.com/solutions/7068083

This is specifically addressed in the post you are replying to

Can you elaborate? What I see about Linux is that Crowdstrike was in the process of adopting eBPF which is ostensibly immune to kernel panics, but that issue shows their eBPF implementation specifically causing a kernel panic.

Re: No More Blue Fridays

#223

Post by becurious »

adolph wrote: post #202
becurious wrote: post #143

Earlier quoted context omitted.

But Apple doesn’t have the industrial and commercial uses that Linux and Windows have. Where you can’t suddenly switch out to a new architecture without massive amounts of validation costs. At my previous job they used to use Macs to control scientific instrumentation that needed a data acquisition card. Eventually most of the newer product lines moved over to Windows but one that was used in a validated FDA regulate…

Sounds like they need a nice Hackintosh for that validated FDA regulation app-OS-HW combo.

Good luck getting that through a regulated company’s Quality Management System or their legal department. Way too much business risk and the last thing you want is a yellow or red flag to an inspector who can stop ship on your product until all the recall and remediation is done.

Re: No More Blue Fridays

#224

Post by olddustytrail »

nkozyra wrote: post #221
guipsp wrote: post #110

Earlier quoted context omitted.

This is specifically addressed in the post you are replying to

Can you elaborate? What I see about Linux is that Crowdstrike was in the process of adopting eBPF which is ostensibly immune to kernel panics, but that issue shows their eBPF implementation specifically causing a kernel panic.

Yes, the elaboration is that the same link you posted is included in the article you're supposed to have just read.

Re: No More Blue Fridays

#225

Post by CodeWriter23 »

nequo wrote: post #118
CodeWriter23 wrote: post #84

Earlier quoted context omitted.

> At Ring 3 it would crash an app, not the entire OS. That's still an outage for those key systems.

It is an outage for the monitoring system, not the system that it monitors.

I think a reasonable protocol is to stop using any apps when your cyber protection crashes. Why have that suite at all otherwise?

Re: No More Blue Fridays

#226

Post by joker99 »

I used to work for an EDR vendor and this post glosses over two major and important things. 1. There’s no need for eBPF on windows, it has the ETW framework (event tracing) which is much more powerful and provides applications subscribing to a class of events almost too detailed insights. the issue most AV vendors have with it though is speed. Leading to … 2. eBPF lets you watch. Congrats. It’s something, but it’s not the reason why these tools are deployed. Orgs deploy these tools to prevent or stop potentially bad stuff from executing. The only place this can be done in our operating systems is usually the kernel - for that you need kernel level drivers or various other filter drivers.

Crowdstrike screwed the pooch here, yes. But after a couple of days I feel like I haven’t read enough blog posts and articles that crap on Microsoft. It’s their job to build a secure operating system, instead they deliver Windows and because they themselves cannot secure windows, they ship defender… and we use tools like falcon like a bandaid for Microsofts bad security practices

Re: No More Blue Fridays

#227

Post by kjellsbells »

Lets suppose that eBPF solves this particular problem, eventually, for Windows. Doesn't sidestepping the entire class of Crowdstrike-style fubars require that Microsoft then mandate that no, backward compatibility will not be offered?

Back compat seems to be such a shibboleth in the Windows world, but comes at an incredible price. The reasons cited all seem to boil down to keeping some imagined customers' obscure LOB app running for decades. But that seems like an excuse to me. Surely Microsoft would like to shake out the last diehards running some VB5 app on a patched up PC in a factory. Isn't it more beneficial to everyone to start sunsetting acres of ancient NT code and approaches and streamline the entire attack surface?

Re: No More Blue Fridays

#228

Post by lmm »

sunnyps wrote: post #197
SoftTalker wrote: post #134

Earlier quoted context omitted.

Also that lines of code is a proxy for rigor, something new I learned today. /s

I think they mean that the code base is small enough to be audited thoroughly. Maybe they should reword it to be clearer.

> I think they mean that the code base is small enough to be audited thoroughly.

They wouldn't say it was "over 20,000 lines" in that case. And 20,000 lines of C is far too big to audit.

Re: No More Blue Fridays

#229

Post by ahepp »

shrx wrote: post #18

From the article: > If the verifier finds any unsafe code, the program is rejected and not executed. The verifier is rigorous -- the Linux implementation has over 20,000 lines of code [0] -- with contributions from industry (e.g., Meta, Isovalent, Google) and academia (e.g., Rutgers University, University of Washington). [0] links to https://github.com/torvalds/linux/blob/master/kernel/bpf/ver... which has this inter…

If you’re wrong about the loop, you’ll still hit BPF_MAXINSNS, so it’s fine to use heuristics that could produce a false negative right?

Re: No More Blue Fridays

#230

Post by devbent »

marcosdumay wrote: post #135
throwaway2037 wrote: post #94

Earlier quoted context omitted.

This claim about SQL Server: Is it due to disk access being slower from NT kernel compared to Linux kernel?

There's something very wrong with Windows disk access, you can see it easily by trying to run a Windows desktop with rotating disks. But SQL Server is in the unique position of being able to optimize Windows for their own needs. So they shouldn't have this kind of problem.

The file system is almost 30 years old.

When NTFS came out it was way better than anything on Linux. Heck even in 2006 NTFS was better.

But Linux keeps getting new file systems while Windows keeps NTFS.

Post reply on HN