Comment by flakiness | Hacker News Reader

Comment by flakiness | Hacker News Reader

Why now, and why DTrace (vs BPF)? Looking at the doc [1]:

> Check that you are running a supported version of Windows. The current download of DTrace is supported in the Insider builds of 20H1 Windows after version 18980 and Windows Server Build 18975. Installing this version of DTrace on older versions of Windows can lead to system instability and is not recommended. The archived version of DTrace for 19H1 is available at Archived Download DTrace on Windows. Note that this version of DTrace is no longer supported.

So it's not "now", but has been there for a while. Also it might not be very helpful to align with BPF anyway as the kernel itself is totally different thus any tool reuse wouldn't be very practical.

[1] https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

It probably helps that OpenDTrace has a published specification that you can use to not only to reimplement bits of DTrace from scratch but also to agree on a common behavior across many operating systems: https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-924.pdf

Dtrace was added to windows before the bpf system was. This is a bit over two years old now.

You made me realize that Windows does supprot BPF! I saw that before but forgot about that. Thanks for the reminder! Such a crazy operating system (an applause.)

https://cloudblogs.microsoft.com/opensource/2021/05/10/makin...

Why? Because dtrace is portable, has been ported to all major OS, and safe, and has a lot of bindings in a lot of apps and libs already. It seemlessly integrates kernel and Userland calls.

whilst eBPF is Linux only, and completely insecure. with almost none existing userland bindings.

eBPF is not Linux only. Windows is investing into integrating it to their OS and some efforts have begun applying it to the BSDs. There's even a recent initiative to standardize the eBPF runtime.

eBPF can work with Dtrace's USDTs as well as dynamic u(ret)probes.

Dtrace on Linux is built on top of eBPF.

Reply on news.ycombinator.com