Recent submissions

Comment · 11 months ago
Sure, and the VR market hasn't ossified and settled yet so it's still anyone's game.
Comment · 11 months ago
Absolutely. This is a long term strategy stemming from the moment Microsoft spawned their app store.

A lot of people are missing the fact that the Steam Frame is Valve's attempt at staking a position in the wide-open and malleable VR space.

With Google, they identified that Microsoft developing their own search engine as an existential threat. Additionally, Internet Explorer being the only bottleneck for the web as a platform was a problem. And thus they broke it wide open, developing web technologies, investing in Firefox initially, releasing Chrome, and ultimately delivering Android.

In mobile, Microsoft came too late to respond to Apple and Google.

Meta and Apple have identified that VR is one of the next gold-mines in terms of a similar app-store and experience rich ecosystem potential comparable to PCs, web, and mobile, and have poured billions into development of hardware and software. It's documented that Meta attempted to create a proprietary OS for their VR headsets (and has debatable success).

Valve, while having fewer resources than any of the behemoths above, decided to hedge their bets with Linux and entering the market first through their well established brand built with video games. It would not surprise me if the Steam Frame begins their entry into other entertainment experiences and app opportunities. Microsoft has reasonable success weaving their ecosystem together (PC + Xbox), but they're foolish to think that their dominance would continue into VR because they have the PC space... They made that mistake with Windows Phone.

Comment · 1 year ago
Comment · 2 years ago
Comment · 2 years ago
Comment · 3 years ago
Comment · 3 years ago
While the TrailOfBits post is informative, they extrapolate the wrong premise from Brendan Gregg's original post[1]. Brendan's statement was originally about the particular set of eBPF tools created for observability (especially his own). These tools (like bcc and bpftrace) are specifically geared towards observability and were not built for security in mind, nor will they be "patched" or fixed for these purposes.

Does this imply that eBPF is a bad foundation for security-focused tooling? Brendan states the following at the close of this blog post:

> There is potential for an awesome eBPF security product, and it's not just the visibility that's valuable (all those arrows) it's also the low overhead. These slides included our overhead evaluation showing bcc/eBPF was far more efficient than auditd or go-audit. (It was pioneering work, but unfortunately the slides are all we have: Alex, I, and others left Netflix before open sourcing it.) There are now other eBPF security products, including open source projects (e.g., tetragon), but I don't know enough about them all to have a recommendation.

> Note that I'm talking about the observability tools here and not the eBPF kernel runtime itself, which has been designed as a secure sandbox. Nor am I talking about privilege escalation, since to run the tools you already need root access (that car has sailed!).

This reads to me that security tooling built on top of eBPF is possible and various organizations are in-flight making it happen (such as Falco[2], Tetragon[3], and Tracee[4]). These teams have recognized the shortcomings of eBPF and are layering other kernel-instrumentation capabilities such as kprobes and LSM hooks into their solutions.

Additionally, the TrailOfBits blog post states:

> Developers need to be aware of pitfalls like probe unreliability, data truncation, instruction limits, concurrency issues, event overload, and page faults. Workarounds exist, but they are imperfect and often add complexity.

These inherent limitations exist primarily because eBPF is a virtual machine within kernel space. Many of these constraints exist because eBPF programs should _never_ lock up the kernel. The eBPF verifier[5] does some checks on the possible code paths the program can take, such as finite bounded loops, null checks on variables, etc. The foundational aspect here is that the eBPF virtual machine is designed to protect the kernel while running programs in kernel space, and that imperfect/complex workarounds may be needed by security-focused projects to respect that foundation.

[1] https://www.brendangregg.com/blog/2023-04-28/ebpf-security-i... [2] https://github.com/falcosecurity/falco/ [3] https:/github.com/cilium/tetragon [4] https://github.com/aquasecurity/tracee [5] https://docs.kernel.org/bpf/verifier.html

Comment · 3 years ago
Comment · 3 years ago
I wanted to chime in here that I agree with (1) as well.

In the time before Chrome, Firefox market share grew in part because of how aggressively Google and the rest of the web advertised for them. However, that market share peaked and shrunk after Chrome was released; Google shifted _all_ of their advertising from Firefox for Chrome.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton