> This approach avoids the overly restricted verification requirements (e.g., program complexity constraints)
Maybe i'm missing something, but isn't that a bad thing?
The things you're missing:
1. This requires root.
2. eBPF also requires root usually. As I understand it it was originally meant to be secure enough to allow unprivileged use but Spectre ruined that and now they've given up on that.
"Bad thing" is an understatement.
Yes, very bad, even worse when coming from supposedly security conscious programming language community.
Depends. If you want to implement a very fancy kernel level tracing tool for your local environment, why would it be a bad thing? Worst case you'll lock up your system and have to reboot.
But you wouldn't want to use that for the actual firewall for example, or with a production service. There's no general "bad". Just different contexts.