No More Blue Fridays • Hacker News Board

Re: No More Blue Fridays

#241

Post by nrr » Tue, Jul 23, 2024, 4:34 AM UTC

riskable wrote: post #166

throwaway2037 wrote: post #94

Earlier quoted context omitted.

This claim about SQL Server: Is it due to disk access being slower from NT kernel compared to Linux kernel?

I had read previously from an unverified SQL Server engineer that the thing they wanted most (with Linux support) was proper containerization (from a developer perspective). Apparently containers on Windows just don't cut it (which is why nobody uses them in production). Take it with a grain of salt though. I don't think they'd ever admit that filesystem performance was an issue (though we all know it is; NTFS is ove…

It's my understanding, having done benchmarks on file access on Windows, that NTFS itself is not the problem. It's old, but the revision of the on-disk structure that we use today hails from Windows XP, and it's about on par in terms of feature parity (and backwards compatibility, given that I can still read native NT 3.51 volumes on Windows 11) with ext4.

A lot of the weirdly bad performance comes from all of the machinery that Windows wraps around file access for things like filter drivers. As long as you don't, say, indiscriminately follow every CreateFile() with a CloseHandle() and instead treat handle closure like garbage collection, you can actually eke out pretty good performance.

That all said, yeah, Windows containers are less than great for what I'd argue is one strikingly glaring flaw: Docker container images are built from smss.exe upward. That makes them not immediately portable between ntoskrnl.exe releases.

Re: No More Blue Fridays

#242

Post by userbinator » Tue, Jul 23, 2024, 4:51 AM UTC

In the future, computers will not crash due to bad software updates, even those updates that involve kernel code.

100% BS. Even if they don't "crash" they will "stop functioning as intended" which is just the same. It's absolutely disgusting how this industry is now using this one outage as a talking point to further their totalitarian agenda.

It reminds me of how Google went after adblockers with their new extension model that also promised more "security". It's time we realised what they're really trying to do. In fact, I wonder whether this outage was not accidental after all.

Re: No More Blue Fridays

#243

Post by yubiox » Tue, Jul 23, 2024, 5:23 AM UTC

Title reminds me of when microsoft promised no more UAEs back in 92. They just renamed them to GPFs in windows 3.1.

Re: No More Blue Fridays

#244

Post by duskwuff » Tue, Jul 23, 2024, 6:16 AM UTC

odo1242 wrote: post #152

Xunjin wrote: post #100

Earlier quoted context omitted.

> The safest kernel is the one that cannot be touched at runtime. Can you expand what you mean here? Because depending on the application you are running, you will need at least talk with some APIs to get privileged access?

Yeah, Apple doesn’t allow any user code to run in kernel mode without significant hoops (the kernel is code signed) and tries to provide a user space API (e.g. DriverKit) as an alternative for the missing functionality. Some things (FUSE) are still annoying though.

> Some things (FUSE) are still annoying though.

That should get much easier in macOS Sequoia with FSKit.

https://developer.apple.com/documentation/fskit/

Re: No More Blue Fridays

#245

Post by jeffrallen » Tue, Jul 23, 2024, 6:45 AM UTC

Here's an idea for an interesting hack: a piece of kernel resident code that feeds fake data into eBPF so that an eBPF-based antimalware will see nothing bad as the malware goes about it's merry way.

Sandboxes are safe, but are ultimately virtual machines, and virtual machines can be made to live in a world that's not real.

Re: No More Blue Fridays

#246

Post by egorfine » Tue, Jul 23, 2024, 7:33 AM UTC

supriyo-biswas wrote: post #240

egorfine wrote: post #183

One option to prevent this is to not run corporate spyware. But I guess for some industries this isn't an option.

I don’t understand statements like this. You only need to have some employee install some malware (unintentionally or otherwise); and you have a data breach on your hands.

I agree it's much more scalable to have a vendor install a spyware on all your workstations and have a centralized data breach.

Re: No More Blue Fridays

#247

Post by rldjbpin » Tue, Jul 23, 2024, 7:55 AM UTC

blinkingled wrote: post #30

Ok. But the good old push code to staging / canary it before mainstream updates was a simpler way of solving the same problem. Crowdstrike knows the computers they're running on, it is trivial to implement a system where only few designated computers download and install the update and report metrics before the update controller decides to push it to next set.

with the way they handled the debian crashing a little while ago, frankly they are happy to still go ahead with testing this way. still much better way to handle things than pushing to everybody at the same time.

Re: No More Blue Fridays

#248

Post by worthless-trash » Tue, Jul 23, 2024, 8:20 AM UTC

nequo wrote: post #92

worthless-trash wrote: post #32

Earlier quoted context omitted.

On the upside, non root users can't insert ebpf code, so its a priv'ed operation, not like other distros.

Isn’t it tied to CAP_BPF on every distro since the 5.8 kernel? https://mdaverde.com/posts/cap-bpf/

Rhel8 is based on 4.18 RHEL9 is based on 5.14 , i think it still has the same restriction ( kernel.unprivileged_bpf_disabled ).

I reckon Red Hat may duplicate upstreams behavior by RHEL10.

Re: No More Blue Fridays

#249

Post by psd1 » Tue, Jul 23, 2024, 8:48 AM UTC

stackskipton wrote: post #108

throwaway2037 wrote: post #94

Earlier quoted context omitted.

This claim about SQL Server: Is it due to disk access being slower from NT kernel compared to Linux kernel?

It's just easier for everyone involved (outside Windows GUI clicker admins) if it runs on Linux. Containerization is easier, configuration is easier and operating system is much more robust.

Operating system can be more robust, depending on admin skill. Let idiots configure and operate your rhel and you may not get those five nines.

There are costs to it, in the form of architectural baggage and slower iteration, but what windows brings to the table is a deck swept mostly clear of footguns. That can give you a different form of robustness.

Re: No More Blue Fridays

#250

Post by psd1 » Tue, Jul 23, 2024, 8:55 AM UTC

queuebert wrote: post #213

recursive wrote: post #191

Earlier quoted context omitted.

> what new functionality does Windows 11 actually have that Windows XP didn't have? ( Off the top of my head, built-in bluetooth support, an OS-level volume mixer, and more support for a wider variety of class-compliant devices. I'm sure there are a lot more, and if you actually care about the answer, I don't think it would be hard to find.

All of this could've been added to XP, right?

Longhorn was a significant rewrite, actually. The two big upheavals in windows history were: 2000, which essentially scrapped the 95 lineage in favour of NT; and Vista, which kicked a lot of 3rd-party crap out of the kernel and added a quality gate for drivers.