Microsoft & Others Form The eBPF Foundation

[debrouxl]

Ten years from now when security researchers find all the security holes, there are going to be some painful mitigations for dealing with this.

Exactly. They're already working on it:

Thread https://mobile.twitter.com/andreyknv...97975979102217 : "The cool part about eBPF-based rootkits is portability.
A kernel module–based rootkit needs to be rebuilt when a new kernel is deployed."

Fortunately, Debian has recently started disabling unprivileged BPF by default on the sid kernels.

[onlyLinuxLuvUBack]

Enqueue the Microsoft hatred

Looking at the list of evil companies, they would all like to control your life,content,freedom and your os.

[onlyLinuxLuvUBack]

Can you imagine sitting at the linux "Foundation" meeting:

Microsoft: Ok guys you know if they run linux we can't control them,
we can't bend them over and mine their data.

Crowd(Google etc): No... no... why ?
Microsoft: Silence. I have a plan, we all joined this foundation
so we could corrupt linux and be able to control it, no ?
If the linux "Foundation" changes linux then who would stop us ?

CCP: Son, we have our own list of patches that you must apply and
if you don't apply them then no business in our country for you.

[timofonic]

Is eBPF a really good idea in long term cases? Many very experienced people disagree.

Those very big corps have lots of resources that make them possible to have LOTS of security layers, many of them extremely secret and NEVER will be published or known outside their extremely paranoid environments. Despite of that, they have LOTS of security leaks (is Google less prone than the rest?).

It may make certain stuff faster, such as load balancing and even replace iptables. What's the real cost of it?

Buzzwords aren't enough...

[jacob]

Can you imagine sitting at the linux "Foundation" meeting:

Microsoft: Ok guys you know if they run linux we can't control them,
we can't bend them over and mine their data.

Crowd(Google etc): No... no... why ?
Microsoft: Silence. I have a plan, we all joined this foundation
so we could corrupt linux and be able to control it, no ?
If the linux "Foundation" changes linux then who would stop us ?

CCP: Son, we have our own list of patches that you must apply and
if you don't apply them then no business in our country for you.

Phoronix readers: Hey guys, you know the latest conspiracy theory. They are out to get us. No passaran, prepare your tinfoil hats! Them evil companie$ shall not make my irrelevant toy OS into something usable in the real world! Them won't submit a single line of codez into the system I use to run Xlogo! Not a single bit in my systemz will come from Micro$oft or Google and of course when I need to get something real done, I'll use Winblob$ or Mac because my uber anti kapitalist Linux can't do it.

Right?

[rabcor]

So... Is this actually supposed to do something? In-kernel virtual machines I heard, I mean that sounds kinda interesting, creepy as all hell and largely defeating the point of VMs in the first place, but interesting nontheless..

I just don't see why we would want something like that in the mainline linux kernel, I don't see why this stuff shouldn't be out-of-tree or in a different kernel line targeted at whatever people actually want to use this feature.

This is clearly not a core feature that belongs in every linux kernel, reeks of pointless bloat to me.

All this work to make the kernel bigger when we should be working to make it smaller.

[arQon]

to me this is like creating backdoor on the linux kernel itself?

Exactly so. BPF was originally for inspecting and processing network traffic, but it has a lot more visibility into the system these days (which it needs to be able to do the things we want it to do).
It's a safe bet that when a group of dedicated privacy rapists show an interest in something, it's so that they can gather more information from users.

[HEL88]

Even after reading through their website I still don't understand what's the use for this. What can we do with eBPF that we couldn't do before? Is this about making Linux more like a micro kernel where drivers and modules have limited privilege and are isolated from each others?

Like in new Windows (hypervisor-protected code integrity)). So, new Windows required MBEC from CPU to fast crossing between hypervisor memory page and user memory page (eg. Skylake and older - not supported).

[Alexmitter]

I do not think Linux has a need for those BSD originated technologies as they are often quite badly designed.
That Microsoft and other cloud providers care for it is quite clear on the other side, its mainly a network filter technology after all.

Best BS so far:
Something with the CCP
Something with Microsoft spying on you with Berkley package filters.
Something with rootkits.

[linner]

Hey, while we're at it, why not embed Java, Python, PHP, and Javascript directly in the kernel?! I mean it's the ultimate flexibility for expanding the kernel without needing to make a proper module, etc. Just load and run your scripts right in the kernel. What could possibly go wrong!