Additionally, if I'm buying cold medicine there's a really good chance I have a cold, and my ability and inclination to carefully analyze the ingredient list on a box of medicine smear-printed in 3pt sans will likely be diminished.
Can confirm. Renaming Ethereal to Wireshark involved a bunch of code and documentation updates, registering word and design trademarks across jurisdictions, and in our case we didn't have control over the old domain, so I had to contact a bunch of people linking to ethereal.com and ask them to link to wireshark.org instead. I don't know if the last part would even be possible today.
No clue if that exact image was altered, but I do a fair amount of road biking east of Napa and Sonoma, and on some days the sky and hills look just like the photo.
If I read the sentence correctly they're saying that past reports were AI slop, but the state of the art has advanced and that current reports are valid. This matches trends I've seen on the projects I work on.
What "distro" package manager is available on Windows and macOS? vcpkg doesn't provide binary packages and has quite a few autotools-shaped holes. Homebrew is great as long as you're building for your local machine's macOS version and architecture, but if you want to support an actual user community you're SOL.
I ran into a similar situation a couple of years ago. It wasn't at the scale you describe, but it was an absurd number of requests for a ~80 MB software installer. I ended up redirecting the offending requests to a file named "please-stop.txt" that contained a short note explaining what was happening and asking them to stop. A short time later they did.
I lead a large-ish open source software project. We have developers that need to build on Linux, macOS, and Windows. It's useful to be able to get everyone bootstrapped with as few steps as possible and with as few dependencies as possible. For our uses CMake works well as a universal superbinary, but I'm always on the lookout for tools that can reduce developer friction.
Those tools either don't ship with, or exist in wildly different forms on Windows. It's particularly bad for curl, which might be the real curl.se curl or Microsoft's confusingly-named Powershell alias.
I could definitely see using this in a cross-platform build or installation environment.
For plain C/C++ you can just pass `-arch x86_64 -arch arm64` to clang. CMake takes care of this for you if you specify `CMAKE_OSX_ARCHITECTURES=x86_64;arm64` and IIRC Meson has similar functionality.
For us (Wireshark) the difficulty wasn't with our own codebase, but with getting our dependencies ported over. Most libraries built just fine, but some strongly assumed that "Windows" meant "x86".
It's not just Windows, either. Many libraries (particularly ones that use Autotools) are absolutely blind to the notion that you might want a universal binary on macOS.
There's also 13-W3: DB shell, 13 pins, 3 of them coax: https://en.wikipedia.org/wiki/DB13W3. They were used for high-end workstation video back in the day.
The One Weird Trick I learned was to to get a company attorney to write a professional opinion letter saying that you are indeed authorized to get a cert on behalf of your company.
You might try passing `--modern-bpf` to sysdig. It has traditionally captured syscalls using a kernel module, and it sounds like that's where your errors are coming from. Newer versions have added eBPF support, which doesn't require a kmod but you have to pass in the `--modern-bpf` flag.
In this case you would presumably have a capture file that contained syscall events at both the macOS boundary and at the Linux VM boundary. At the present time it would be like capturing traffic on either side of a firewall and loading it into Wireshark (which is something people do!) You'd have to correlate the events visually/manually but adding an automatic correlation feature is well within the realm of possibility.
Done. We've been upgraded from medium-risk "grayware" to low-risk "generally do not contain content that is useful to the end user" which is technically better, I suppose.
Update: We're now Low-Risk / Computer-and-Internet-Info.
The tools are similar in many ways, but Stratoshark shares Wireshark's dissection, filtering, and UI code, which provides a more low-level details and a free-form filtering language. Stratoshark is currently limited to capture on Linux (we're hoping to expand to macOS and Windows in the future) and the UI runs on all three platforms. There's an enhancement request[1] to add Procmon file support but I haven't had a chance to investigate what that might require.
It uses Falco libs[1] underneath, which supports capture using eBPF or a kmod. I work with the Falco libs team and they go to great lengths to minimize overhead.
Right now the UI runs on Windows, macOS, and Linux but you can only capture system calls on Linux via Falco libs[1]. Expanding local capture to include macOS and Windows is definitely something we'd love to do!
We don't share any code with DTrace, but it's not a bad analogy. As with my other reply about strace, it'd be interesting to see if we can more closely integrate Stratoshark, strace, and DTrace in the same way that Wireshark integrates with tcpdump.
Pretty much. It's part of the same ecosystem as Sysdig OSS[1], which works much like strace. It uses the same underlying libraries as sysdig and Falco, and you can move capture files between them.
It'd be interesting to see if we can integrate more fully with strace as well, but that might require updating strace itself.
You're welcome! It was initially developed as part of my day job at Sysdig, a cloud security company. The initial feature set and use cases focus on getting .scaps (system call and log captures) from cloud environments, but you're entirely correct -- this has much more general applications including troubleshooting and education just like Wireshark does on the networking side.