News for hackers. Stuff that matters.

A comment on CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability. Parent comment

Re:CVE-2023-2163: How we found and fixed an eBPF Linux Kerne... by tptacek on Thursday August 08, 2024 @06:02PM (#41196808)
Linux has a different design than DTrace; eBPF is more capable as a trusted tool, and less capable for untrusted tools. It doesn't make sense to say one approach has "caught up" to the other, unless you really believe the verifier will reach a state where nobody's going find verifier bugs --- at which point eBPF will be strictly superior. Beyond that, it's a matter of taste. What seems clearly to be true is that eBPF is wildly more popular.
[ Parent | on HN ]
Re:CVE-2023-2163: How we found and fixed an eBPF Linux Kerne... by cryptonector on Friday August 09, 2024 @12:05AM (#41198681)
It's really hard to bring a host to its knees using DTrace, yet it's quite powerful for observability. In my opinion it is better to start with that then add extra power where it's needed.
[ Parent | on HN ]
Re:CVE-2023-2163: How we found and fixed an eBPF Linux Kerne... by tptacek on Friday August 09, 2024 @12:08AM (#41198693)
I understand the argument, but it's clear which one succeeded in the market. Meanwhile: we take pretty good advantage of the extra power eBPF gives us over what DTrace would, so I'm happy to be on the golden path for the platform here. Like I said, though: this is a matter of taste.
[ Parent | on HN ]