Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In this very thread there was report of a Debian Linux fleet being kernel crashed in exactly the same scenario by exactly the same malware few months ago.

So the only blame Windows can take is its widespread usage, compared to Debian.




there's an eBPF mode for linux which is safe(r)

so windows can still be blamed for not providing a relatively safe way of doing this.


https://access.redhat.com/solutions/7068083

Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process.

eBPF program causes kernel panic on kernels 5.14.0-410+ .

Apparently not safe enough for CrowdStrike.


Windows supports eBPF too.


Why the whataboutism?

Yes, the Linux device driver has many of the same issues (monolithic drivers running in kernel space/memory). I’m not sure what the mitigations were in that case, but I’d be interested to know.

But we both know this isn’t the only model (and have commented as such in the thread). MacOS has been moving away from this risk for years, largely to the annoyance of these enterprise security companies. The vendor that was used by an old employer blamed Apple on their own inability to migrate their buggy EDM program to the new version of macOS. So much so that our company refused to upgrade for over 6 months and then it was begrudgingly allowed.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: