Hacker News Reader

Comment by shahahqq | Hacker News Reader

I hope though that Microsoft will double down on their eBPF support for Windows after this incident.

Keep in mind they don't just allow any old code to execute in the kernel.

They do have rigorous tests (WHQL), it's just Crowdstrike decided that was too burdensome for their frequent updates, and decided to inject code from config files (thus bypassing the control).

The fault here is entirely with Crowdstrike.

Is there any evidence that the config files had arbitrary code in them? The only analysis I'd seen so far indicated a parsing error loading a viral signature database that was routinely updated, but in this case was full of garbage data.

Perhaps not verified, but some smart people do have convincing arguments:

https://youtu.be/wAzEJxOo1ts?si=UNNxAN27VV1E6mcP&t=505

Any article/blog/text-that-can-be-read?

Don't bother. He just repeats a tweet saying a null+offset dereference and also the speculation of that null picked from the sys file.

How rigorous are the tests if faulty data can brick the machine?

Not rigorous enough to have detected this flaw in the kernel sensor, although effectively any bug in this situation (an AV driver) can brick a machine. I imagine WHQL isn't able to find every possible bug in a driver you submit to them, they're not your QA team.

Doubt it. Microsoft is clearly over Windows. They continue to produce it but every release feels like "Ugh, fine, since you are paying me a ton of money."

Internally, Microsoft is running more and more workloads on Linux and externally, I've had .Net team tell me more than once that Linux is preferred environment for .Net. SQL Server team continues to push hard for Linux compatibility with every release.

EDIT: Windows Desktop gets more love because they clearly see that as important market. I'm talking more Windows Server.

They aren't over windows. They continue to be incredibly interested in and actively developing how much money they can suck from their users. Especially via various forms of ads.

But yeah, kernel features are few and far between.

I believe the term you are looking for is "rent seeking". Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have? (I'm being generous with XP, because actually 95 was already mostly internet ready.) Yet how many times have many of us paid for a Windows license on a new computer or because the old version stopped getting updates?

> Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have?

Off the top of my head, limiting myself to just NT kernel stuff: WSL and Hyper-V, pseudo-terminals, condvars, WDDM, DWM, elevated privilege programs on the same desktop, font driver isolation, and limiting access to win32k for sandboxing.

> what new functionality does Windows 11 actually have that Windows XP didn't have? (

Off the top of my head, built-in bluetooth support, an OS-level volume mixer, and more support for a wider variety of class-compliant devices. I'm sure there are a lot more, and if you actually care about the answer, I don't think it would be hard to find.

All of this could've been added to XP, right?

I don't know.

If it could, Then XP would just be Windows 11. What's the objection here.

Simple patches/upgrades vs tricking people into thinking you've made a whole new piece of software. Linux, BSD, and Apple roll out OS upgrades with new functionality without charging for the new versions.

That's one perspective I suppose. I have a MacBook on my desk at work solely for testing in Safari. I can no longer use it for that purpose because it won't even let me upgrade the OS. That sounds like a whole new piece of software to me. Windows actually has been substantially re-written. I guess MacOS has also? It seems more honest to me call it a different product.

Not that I strongly care much one way or another.

Longhorn was a significant rewrite, actually. The two big upheavals in windows history were: 2000, which essentially scrapped the 95 lineage in favour of NT; and Vista, which kicked a lot of 3rd-party crap out of the kernel and added a quality gate for drivers.

The Win95 lineage still existed, in the form of Windows ME, alongside 2000. XP is when they got rid of it and unified the two product lines.

> Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have?

Modern crypto ciphersuites that aren't utterly broken? Your best options for symmetric crypto with XP are 3DES (officially retired by NIST as of this year) and RC4 (prohibited in TLS as of RFC 7465).

(And if you think 3DES isn't totally broken by itself, you're right... except for the part where the ciphersuite in question is in CBC mode and is vulnerable to BEAST. Thanks, mandated ciphersuites.)

> Other than visual changes, what new functionality does Windows 11 actually have that Windows XP didn't have?

XP->Vista alone brought a bunch of huge changes that massively improved security (UAC), capability (64 bit desktops), and future-proofing (UEFI) among many many other things.

Some helpful Wikipedia editors have answered this question in excessive detail, so I'm just going to link those for more info. Also I'm going to start with what XP changed from 2003 both because it makes a good comparison and I'd argue 2000/NT 5.0 is the root of the modern Windows era. Your next sentence after the quote implies you probably won't have a problem with that.

* XP/2003: https://en.wikipedia.org/wiki/Features_new_to_Windows_XP

* 2003R2: https://en.wikipedia.org/wiki/Windows_Server_2003#Windows_Se...

* Vista: https://en.wikipedia.org/wiki/Features_new_to_Windows_Vista

* 2008: https://en.wikipedia.org/wiki/Windows_Server_2008#Features

* 7: https://en.wikipedia.org/wiki/Features_new_to_Windows_7

* 2008R2: https://en.wikipedia.org/wiki/Windows_Server_2008_R2#New_fea...

* 8: https://en.wikipedia.org/wiki/Features_new_to_Windows_8

* 2012: https://en.wikipedia.org/wiki/Windows_Server_2012#Features

* 8.1: https://en.wikipedia.org/wiki/Windows_8.1#New_and_changed_fe...

* 2012R2: https://en.wikipedia.org/wiki/Windows_Server_2012_R2#Feature...

* 10: https://en.wikipedia.org/wiki/Features_new_to_Windows_10

* 2016: https://en.wikipedia.org/wiki/Windows_Server_2016#Features

* 2019: https://en.wikipedia.org/wiki/Windows_Server_2019#Features

* 2022: https://en.wikipedia.org/wiki/Windows_Server_2022#Features

* 11: https://en.wikipedia.org/wiki/Features_new_to_Windows_11

* 2025: https://learn.microsoft.com/en-us/windows-server/get-started...

Obviously some of this will be "fluff" and that's up to your own personal definitions, but to act like there haven't been significant changes in every major revision is just nonsense.

Well that Windows 11 article is laughably short, considering it's a major version. But I appreciate you taking the time to compile all those links.

My point is the vast majority of this stuff is either "fluff" or cosmetic changes or random things that 99% of users don't use OR they are security and bug patches. HN users are not typical, so I'm sure some of the Windows updates are very important for people like us.

Maybe to Microsoft this is a significant rewrite: "The Calculator has been completely rewritten in C# and includes several new features." (Just picked at random.) Ok, but like why? Who cares? What was wrong with the last calculator? Absolutely nothing. Also who even uses Windows calculator instead of Excel or their phone? Was calculator rewritten to justify an FTE somewhere at Microsoft?

I'm not trying to troll, but I am trying to be contrarian. I honestly feel like a majority of desktop users don't really think too hard about their OS. None of the existing OSes should be significantly rewritten unless they are just completely flawed. Like say Apple decides to ditch the microkernel or Linux goes to Rust. Most people need stability and security, not new calculator features or different button shading. I'm singling out Microsoft for being the only one that rent seeks for superfluous changes. Apple is notoriously bad about wasting users time with constant updates for dumb stuff, but at least it's free, except for the cost of time while your computer slowly reboots and updates.

This claim about SQL Server: Is it due to disk access being slower from NT kernel compared to Linux kernel?

It's just easier for everyone involved (outside Windows GUI clicker admins) if it runs on Linux. Containerization is easier, configuration is easier and operating system is much more robust.

Operating system can be more robust, depending on admin skill. Let idiots configure and operate your rhel and you may not get those five nines.

There are costs to it, in the form of architectural baggage and slower iteration, but what windows brings to the table is a deck swept mostly clear of footguns. That can give you a different form of robustness.

There's something very wrong with Windows disk access, you can see it easily by trying to run a Windows desktop with rotating disks.

But SQL Server is in the unique position of being able to optimize Windows for their own needs. So they shouldn't have this kind of problem.

The file system is almost 30 years old.

When NTFS came out it was way better than anything on Linux. Heck even in 2006 NTFS was better.

But Linux keeps getting new file systems while Windows keeps NTFS.

AFAIK, NTFS is a perfectly ok design. But the Windows file system never performed well. This is probably not for architectural reasons.

And no, it didn't perform better at NT4, XP, or Win7 times.

I had read previously from an unverified SQL Server engineer that the thing they wanted most (with Linux support) was proper containerization (from a developer perspective). Apparently containers on Windows just don't cut it (which is why nobody uses them in production). Take it with a grain of salt though.

I don't think they'd ever admit that filesystem performance was an issue (though we all know it is; NTFS is over 30 years old!).

> though we all know it is; NTFS is over 30 years old!

ext2, which is forwards compatible with ext3 and ext4, is slightly older than NTFS

It's my understanding, having done benchmarks on file access on Windows, that NTFS itself is not the problem. It's old, but the revision of the on-disk structure that we use today hails from Windows XP, and it's about on par in terms of feature parity (and backwards compatibility, given that I can still read native NT 3.51 volumes on Windows 11) with ext4.

A lot of the weirdly bad performance comes from all of the machinery that Windows wraps around file access for things like filter drivers. As long as you don't, say, indiscriminately follow every CreateFile() with a CloseHandle() and instead treat handle closure like garbage collection, you can actually eke out pretty good performance.

That all said, yeah, Windows containers are less than great for what I'd argue is one strikingly glaring flaw: Docker container images are built from smss.exe upward. That makes them not immediately portable between ntoskrnl.exe releases.

> SQL Server team continues to push hard for Linux compatibility with every release.

It's kinda funny that the DB that was once a fork of Sybase that was ported to Windows is trying to make its way back to Unix.

SQL Server has supported Linux since 2017

Reply on news.ycombinator.com