Hacker News Reader

It can do much more than analyze packets. It's a way of running user defined programs in kernel space with fairly strong assurances that it won't crash the kernel.

BPF programs can hook directly into the kernel more or less and can safely share memory to userspace. This is important because after all the fall out from Spectre and Meltdown, they found that the BPF virtual machine programs were immune from this class of vulnerabilities.

It’s a culmination of decades of research and implementation to mainstream Ring-0 OS kernels that are upgradable at runtime with untrusted userspace code.