No More Blue Fridays (brendangregg.com)

Article summary

The article discusses the potential of eBPF (extended Berkeley Packet Filter) to prevent system crashes caused by bad software updates, particularly those involving kernel code. A recent incident where a security company's update caused widespread Windows crashes is cited as an example of the problem eBPF can solve. eBPF is a secure kernel execution environment that can run safety-checked code, preventing crashes and improving security. The authors argue that eBPF can be a requirement for companies paying for commercial software with kernel drivers or modules.

Main themes

• eBPF benefits
• Kernel programming risks
• Software update safety
• Security solutions
• Windows and Linux kernels

What commenters say

• The adoption of eBPF can prevent system crashes caused by bad software updates, but its effectiveness depends on widespread adoption and proper implementation.
• Some commenters argue that canary deployments, where a small group of customers receive updates first, can help prevent large-scale disasters, while others point out the challenges of implementing this approach in the cybersecurity industry.
• There is disagreement over whether cybersecurity vendors should be transparent with customers about their deployment processes and whether customers should be given the option to opt-in or opt-out of early updates.
• Some argue that virtualization and emulation can be used to test updates before deploying them to customers, potentially preventing bugs like the one that caused the recent Windows crashes.
• The article's focus on eBPF is seen as a way to promote its benefits, rather than specifically shaming the company responsible for the recent incident, which is also working on eBPF adoption.
• The use of eBPF is not a guarantee against all bugs, but it can prevent serious issues that cause system crashes, and its management code has had some bugs in the past, which are being fixed.
• Industry best practices for software deployment, such as canary deployments, should be followed to minimize the risk of large-scale disasters, and customers should be aware of the potential risks and benefits of early updates.
• The incident highlights the need for improved testing and deployment processes in the cybersecurity industry, and the importance of transparency and communication between vendors and customers.