2023

eBPF programming on Windows

eBPF is (now!) a cross-platform technology with origins in the Linux Kernel that can run sandboxed programs in a privileged context such as the operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or write drivers with the native kernel APIs. …

eBPF programming on Windows Read More »

Getting your minifilter signed from Microsoft

Illustration by @Megha. Edited by @Freya Fannie. This document outlines the steps to get a minifilter signed by Microsoft, including registering for the Windows Hardware Dev Center program, purchasing an EV code signing certificate, and using the Windows Hardware Certification Kit (HCK) or Windows Hardware Lab kit (HLK) to run tests and submit a test …

Getting your minifilter signed from Microsoft Read More »

seccomp-pledge: Enforce principle of least privilege in Linux kernel

Pledge is like the forbidden fruit we all covet when the boss says we must use things like Linux. Why does it matter? It’s because pledge() actually makes security comprehensible. Linux has never really had a security layer that mere mortals can understand. — [Justine Tunney](https://justine.lol/pledge/). The Linux kernel is a powerful piece of software …

seccomp-pledge: Enforce principle of least privilege in Linux kernel Read More »

Scroll to Top