Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No More Blue Fridays

brendangregg.com

Post reply on HN
Print view View original

261–270 of 282 posts

Re: No More Blue Fridays

#261

Post by School-Cotton »

amluto wrote: post #252

> In the future, computers will not crash due to bad software updates, even those updates that involve kernel code. In the future, these updates will push eBPF code. eBPF is fantastic, and it can be used for many purposes and improve a lot of things, but this is IMO overselling it. Assuming that BPF itself it free of bugs, it’s still a rather large sprawl of kernel hooks, and those hooks invoke eBPF code, which can c…

How is it possible to panic using bpf_probe_read_kernel ? Can you give an example that works on the current kernel version?

Re: No More Blue Fridays

#262

Post by acdha »

kjellsbells wrote: post #227

Lets suppose that eBPF solves this particular problem, eventually, for Windows. Doesn't sidestepping the entire class of Crowdstrike-style fubars require that Microsoft then mandate that no, backward compatibility will not be offered? Back compat seems to be such a shibboleth in the Windows world, but comes at an incredible price. The reasons cited all seem to boil down to keeping some imagined customers' obscure LOB…

Backwards compatibility slows things down in the Windows world but it doesn’t halt improvements. In this case, there are two powerful ratchets:

1. Compliance: everyone affected by this bug has auditors. Once safer alternatives are available, the standards like CIS, PCI, etc. will be updated to say you should use the new interface, and every enterprise IT department will have pressure to switch to eBPF tools. We saw this with BootLocker: storage encryption used to be a pain, people resisted it, but over time it became universal because the cost of swimming upstream was too high.

2. Signing. Microsoft can start requiring more proof of need and restrictions for signing drivers. They have to be careful to avoid the appearance of favoritism but after this debacle that’s a LOT easier. I would bet some engineer is working on a draft of mandatory fault handling and testing proof requirements for critical kernel drivers now and I would not be surprised to see it include a timeframe for adopting memory-safe languages.

Re: No More Blue Fridays

#263

Post by acdha »

tgtweak wrote: post #195

Even if Microsoft rolls out eBPF and mainstreams it - it will be years before everything is ported over and it still won't address legacy windows versions (which appear to be a good chunk of what was impacted). It's a move in the right direction but it probably won't fully mitigate issues like this for another 5+ years.

Sure, but 5 years is not that long ago - for example, if they’d started right before the pandemic it’d be almost done by now. The best time to have done that was 5 years ago but the second best time is now.

Re: No More Blue Fridays

#264

Post by Archelaos »

roenxi wrote: post #237
Analemma_ wrote: post #210

Earlier quoted context omitted.

This is a weird reading of history. Microsoft has spent tons of effort getting as much code out of the kernel as possible: Windows drivers used to be almost all kernel-mode, now they're nearly all in userspace and you almost never need to write a kernel-mode Windows driver unless you're doing something with deep OS hooks (like CS was, although apparently even that wasn't actually necessary). The safeguards on kernel…

Microsoft made the reasonable point that locking 3rd parties out of the kernel might have resulted in legal challenges in the EU [0]. It is an interesting case where everyone is certain in hindsight that they would have been ok with MS blocking access, but it is less obvious that they would have taken that view if MS had pressured a bunch of security products out of the kernel with no obvious prompting. [0] https://w…

The 2009 agreement with the EU mentioned in the article seems to be the one about the integration of the Internet Explorer (IE) into MS Windows.[1] But it only applied to IE and the commitment was limited to 5 years.[2]

Or is the article referring to something else?

I see no reason why the EU should object to Microsoft's adoption of eBPF as long as MS Defender simply uses the same API that is available to all competitors.

[1] Here is the original text: https://ec.europa.eu/competition/antitrust/cases/dec_docs/39...

[2] See section 4, paragraph 20.

Re: No More Blue Fridays

#265

Post by xp84 »

riskable wrote: post #158
brendangregg wrote: post #81

Earlier quoted context omitted.

Microsoft have been driving the work to make eBPF an IETF industry standard.

...just like they did with Kerberos! And just like with Kerberos they'll define a standard then refuse to follow it . Instead, they will implement subtle changes to the Windows implementation that make solutions that use Windows eBPF incompatible with anything else, making it much more difficult to write software that works with all platforms eBPF (or even just its output). Everything's gotta be different in Windows…

This to me ascribes way too much to mustache-twirling villainy at Microsoft, but to me fails to account for the fact that engineers surely make many of these implementation-detail decisions. These engineers aren’t incentivized to create lock-in. I think it’s more likely that sometimes for a feature to play well with other existing parts of the Windows ecosystem, compromises are made to the standards-compliance. Microsoft may have shipped those related interfaces before this standard had been hashed out, so they have a choice to break everything or to not perfectly follow the standard.

Note: I’m not a Windows dev so I can’t speak to specifics of anything like your Kerberos example. I just don’t believe MS is full of evil engineers, nor that Satya Nadella visits cubicles to promote lock-in practices.

Re: No More Blue Fridays

#266

Post by marcosdumay »

devbent wrote: post #230
marcosdumay wrote: post #135

Earlier quoted context omitted.

There's something very wrong with Windows disk access, you can see it easily by trying to run a Windows desktop with rotating disks. But SQL Server is in the unique position of being able to optimize Windows for their own needs. So they shouldn't have this kind of problem.

The file system is almost 30 years old. When NTFS came out it was way better than anything on Linux. Heck even in 2006 NTFS was better. But Linux keeps getting new file systems while Windows keeps NTFS.

AFAIK, NTFS is a perfectly ok design. But the Windows file system never performed well. This is probably not for architectural reasons.

And no, it didn't perform better at NT4, XP, or Win7 times.

Re: No More Blue Fridays

#267

Post by queuebert »

recursive wrote: post #214
queuebert wrote: post #213

Earlier quoted context omitted.

All of this could've been added to XP, right?

I don't know. If it could, Then XP would just be Windows 11. What's the objection here.

Simple patches/upgrades vs tricking people into thinking you've made a whole new piece of software. Linux, BSD, and Apple roll out OS upgrades with new functionality without charging for the new versions.

Re: No More Blue Fridays

#268

Post by recursive »

queuebert wrote: post #267
recursive wrote: post #214

Earlier quoted context omitted.

I don't know. If it could, Then XP would just be Windows 11. What's the objection here.

Simple patches/upgrades vs tricking people into thinking you've made a whole new piece of software. Linux, BSD, and Apple roll out OS upgrades with new functionality without charging for the new versions.

That's one perspective I suppose. I have a MacBook on my desk at work solely for testing in Safari. I can no longer use it for that purpose because it won't even let me upgrade the OS. That sounds like a whole new piece of software to me. Windows actually has been substantially re-written. I guess MacOS has also? It seems more honest to me call it a different product.

Not that I strongly care much one way or another.

Re: No More Blue Fridays

#269

Post by queuebert »

wolrah wrote: post #215
queuebert wrote: post #167

Earlier quoted context omitted.

I believe the term you are looking for is "rent seeking". Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? (I'm being generous with XP, because actually 95 was already mostly internet ready.) Yet how many times have many of us paid for a Windows license on a new computer or because the old version stopped getting updates?

> Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? XP->Vista alone brought a bunch of huge changes that massively improved security (UAC), capability (64 bit desktops), and future-proofing (UEFI) among many many other things. Some helpful Wikipedia editors have answered this question in excessive detail, so I'm just going to link those for more info. Also I'…

Well that Windows 11 article is laughably short, considering it's a major version. But I appreciate you taking the time to compile all those links.

My point is the vast majority of this stuff is either "fluff" or cosmetic changes or random things that 99% of users don't use OR they are security and bug patches. HN users are not typical, so I'm sure some of the Windows updates are very important for people like us.

Maybe to Microsoft this is a significant rewrite: "The Calculator has been completely rewritten in C# and includes several new features." (Just picked at random.) Ok, but like why? Who cares? What was wrong with the last calculator? Absolutely nothing. Also who even uses Windows calculator instead of Excel or their phone? Was calculator rewritten to justify an FTE somewhere at Microsoft?

I'm not trying to troll, but I am trying to be contrarian. I honestly feel like a majority of desktop users don't really think too hard about their OS. None of the existing OSes should be significantly rewritten unless they are just completely flawed. Like say Apple decides to ditch the microkernel or Linux goes to Rust. Most people need stability and security, not new calculator features or different button shading. I'm singling out Microsoft for being the only one that rent seeks for superfluous changes. Apple is notoriously bad about wasting users time with constant updates for dumb stuff, but at least it's free, except for the cost of time while your computer slowly reboots and updates.

Re: No More Blue Fridays

#270

Post by uticus »

riskable wrote: post #174
uticus wrote: post #121

> eBPF programs cannot crash the entire system because they are safety-checked by a software verifier and are effectively run in a sandbox. Isn’t one of the purposes of an OS to police software? I get that this has to do with the OS itself, but what does watching the watchers accomplish other than adding a layer which must then be watched? Why not reduce complexity instead of naively trusting that the new complexity…

eBPF isn't "watching the watchers" it's just a tool that lets other tools access low-level things in the kernel via a very picky sandbox. Think of it like this: Old way: Load kernel driver, hook into bazillions of system calls (doing whatever it is you want to do), pray you don't screw anything up (otherwise you can get a panic though not necessarily--Linux is quite robust). eBPF way: Just ask eBPF to tell you what y…

> eBPF isn't "watching the watchers"…

> …via a very picky sandbox…

When the eBPF is a CrowdStrike mechanism, and eBPF is “picky,” it is clearly “watching the watchers.”

Post reply on HN