pwny700

Damn, you worked on Tracee AND Ubuntu? Okay, maybe you know how to actually do eBPF right.

eBPF is hard to do right. We couldn’t use Falco in production on our kubernetes infrastructure because of that.

I long for a production-ready runtime monitoring tool that can ACTUALLY be used in a blocking mode. Otherwise we’re always too late, and I’ve been burned more than once when dealing with an incident. Damned hackers always seem to come around weekends and holidays.