Hacker News Reader

stevefan1999

This problem comes from CrowdStrike's agent kernel subsystem itself, and not Windows.

While I agree that Windows, as a client focused operating system, is a hot mess, but I would also compare Windows NT Kernel as much better than Linux Kernel, in terms of code quality and organization. FreeBSD kernel is still my favourite though.

At least Windows NT Kernel have a stable ABI, and Rust for Linux have to bindgen the glue layer for each Linux Kernel build.

View on HN

Windows supports eBPF. CrowdStrike was written before that supports existed, though.

Also eBPF is still in beta for windows and is nowhere near parity with Linux.

A badly written eBPF program at this level could still prevent you from using your computer though. Not in this specific way, but if you use eBPF to prevent other things from running, and you accidentally deploy an eBPF program that, say, triggers on every process start - then you'll prevent every process from running, and the machine will be just as useless as one that doesn't boot at all.

Reply on news.ycombinator.com