Comment by captn3m0

Relevant read from TrailOfBits on the pitfalls of using eBPF for security monitoring: https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-... (Pitfalls of relying on eBPF for security monitoring (and some solutions))

> eBPF is a powerful tool for Linux observability and monitoring, but it was not designed for security and comes with inherent limitations. Developers need to be aware of pitfalls like probe unreliability, data truncation, instruction limits, concurrency issues, event overload, and page faults. Workarounds exist, but they are imperfect and often add complexity.

Maybe eBPF tooling should come with warning labels on what pitfalls are accounted for.