A Google researcher says the Windows NT kernel still “puts Linux to shame” in many ways.
Laurie Kirk, a former Microsoft reverse engineer, argues that NT was built with a cleaner and more consistent security model.
Linux took a different path, adding capabilities, namespaces, cgroups and SELinux over time.
But her most controversial point is about AI agents.
Kirk argues that Linux permissions are spread across too many mechanisms, while NT handles resources, permissions and auditing more consistently.
She even says that if we designed an OS kernel from scratch in 2026, it probably wouldn’t look like Linux.
Linux engineers are already pushing back, defending the modular approach that helped Linux dominate servers, cloud and containers.
Windows vs Linux just got interesting again.
Full story: https://t.co/AaEj3YAGE0
Kubernetes world is moving away from sidecar patterns.
Let me explain why.
A sidecar is a helper container. It sits next to your app container. Same pod. Same network. Same lifecycle.
People used sidecars for a lot of things.
Service mesh was the big one. Envoy would sit next to your app.
- It handled traffic. It handled retries and timeouts. It handled security between services(MTLS). Your app never knew it was there.
- Logging was another one. A small agent would sit next to your app. It would read the logs. It would ship them somewhere else.
- Metrics scraping worked the same way.
- Secrets injection too. Vault agent would run as a sidecar. It would fetch secrets and write them to a file.
This pattern felt smart. One app. Many helpers. No code changes needed.
But then problems showed up.
Every sidecar is another container.
That means more CPU, more memory.
One sidecar on ten pods is fine.
One sidecar on ten thousand pods is not fine.
Every sidecar can crash.
Every sidecar needs patching.
Every sidecar needs upgrading.
Multiply that by hundreds and thousands.
Startup order became a pain too.
- Sometimes the sidecar was not ready before the app started.
- Sometimes the sidecar died before the app finished its work. Small bugs. Big headaches.
Debugging got harder.
- Now you have two containers to check instead of one.
Cost added up quickly at scale.
So the industry asked a new question.
What if we do not need the sidecar at all?
Istio built something called an ambient mesh that required no sidecar injection.
The proxy moves completely outside the pod.
Cilium went even further by using eBPF (a kernel-level technology).
That means the networking logic lives in the kernel, so no sidecar container, and lightning-fast networking.
OpenTelemetry solved this for metrics and logs.
Instead of one sidecar per pod, you get one collector for many pods(runs as a DaemonSet and deployment).
Even Kubernetes noticed the pain.
In version 1.29, it gave sidecars a proper place in the pod lifecycle, fixing a lot of old bugs and startup issues.
It did not remove the sidecar. It just made it better.
Today we have two paths.
Some teams are removing sidecars completely.
Some teams are keeping sidecars but doing it the right way.
Where do you stand?
Most Kubernetes engineers don't know these kubectl tricks that save hours during outages
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗴𝗲𝘁 𝗲𝘃𝗲𝗻𝘁𝘀 -𝗔 -𝘄 | 𝗴𝗿𝗲𝗽 -𝘃 "𝗡𝗼𝗿𝗺𝗮𝗹"
--> Watch only the bad stuff across the entire cluster
> It streams warnings and failures from every namespace in real time so you can catch issues before they turn into incidents.
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗱𝗶𝗳𝗳 -𝗳 𝗱𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁.𝘆𝗮𝗺𝗹
--> See exactly what will change before applying
> It helps catch accidental changes like wrong image tags, deleted environment variables, or broken resource limits before deployment.
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗴𝗲𝘁 𝗽𝗼𝗱𝘀 -𝗔 --𝘀𝗼𝗿𝘁-𝗯𝘆='.𝘀𝘁𝗮𝘁𝘂𝘀.𝗰𝗼𝗻𝘁𝗮𝗶𝗻𝗲𝗿𝗦𝘁𝗮𝘁𝘂𝘀𝗲𝘀[𝟬].𝗿𝗲𝘀𝘁𝗮𝗿𝘁𝗖𝗼𝘂𝗻𝘁'
--> Find unstable pods instantly
> This sorts pods by restart count so the most unstable workloads appear first.
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝘁𝗼𝗽 𝗽𝗼𝗱𝘀 -𝗔 --𝘀𝗼𝗿𝘁-𝗯𝘆=𝗺𝗲𝗺𝗼𝗿𝘆 --𝗰𝗼𝗻𝘁𝗮𝗶𝗻𝗲𝗿𝘀
--> Find who is actually consuming memory
> The `--containers` flag breaks usage down per container instead of showing only pod-level metrics.
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗱𝗲𝗯𝘂𝗴 -𝗶𝘁 <𝗽𝗼𝗱-𝗻𝗮𝗺𝗲> --𝗶𝗺𝗮𝗴𝗲=𝗯𝘂𝘀𝘆𝗯𝗼𝘅 --𝗰𝗼𝗽𝘆-𝘁𝗼=𝗱𝗲𝗯𝘂𝗴-𝗽𝗼𝗱
--> Debug a pod without touching the original workload
> This creates a copy of the failing pod with a debug container attached for investigation.
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗴𝗲𝘁 𝗽𝗼𝗱𝘀 -𝗔 -𝗼 𝘄𝗶𝗱𝗲 --𝗳𝗶𝗲𝗹𝗱-𝘀𝗲𝗹𝗲𝗰𝘁𝗼𝗿 𝘀𝗽𝗲𝗰.𝗻𝗼𝗱𝗲𝗡𝗮𝗺𝗲=<𝗻𝗼𝗱𝗲-𝗻𝗮𝗺𝗲>
--> See every workload sitting on a node before you touch it
> Run this before cordoning or draining a node during maintenance.
𝗸𝘂𝗯𝗲𝗰𝘁𝗹 𝗴𝗲𝘁 𝗲𝘃𝗲𝗻𝘁𝘀 --𝗳𝗶𝗲𝗹𝗱-𝘀𝗲𝗹𝗲𝗰𝘁𝗼𝗿 𝗶𝗻𝘃𝗼𝗹𝘃𝗲𝗱𝗢𝗯𝗷𝗲𝗰𝘁.𝗻𝗮𝗺𝗲=<𝗽𝗼𝗱-𝗻𝗮𝗺𝗲> --𝘀𝗼𝗿𝘁-𝗯𝘆='.𝗹𝗮𝘀𝘁𝗧𝗶𝗺𝗲𝘀𝘁𝗮𝗺𝗽'
--> Get the full chronological event history for one object.
> kubectl describe only shows recent events. This pulls the complete timeline for a specific pod, useful when you're trying to reconstruct what happened over the last hour.
TIL: `ip -br address` shows a neat brief table with interface names, states, and addresses.
I've been breaking my eyes looking for the IP addresses in the cryptic full output for way too many years. But no more!
And a kind reminder: `ip -json address` is also a thing.
‼️ Revolut Data Breach Exposes Customers’ Passport Copies & Full Transaction Histories to Hackers
Details: https://t.co/h7lrKqbfMY
Revolut has disclosed a data-security incident in which sensitive customer information was released after the financial technology company received a fraudulent request that appeared to originate from a legitimate government agency.
The incident reportedly exposed highly sensitive Know Your Customer (KYC) documentation and detailed financial records belonging to a limited number of users, including passport or driver’s license copies, identity-verification selfies, account statements, and complete transaction histories that included Bitcoin-related activity.
#cybersecuritynews
‼️ Microsoft's patch for Windows Defender zero-day ShieldBreak (CVE-2026-69414) is still bypassable, a new PoC called ShieldCrash was published today by researcher Nightmare-Eclipse. It demonstrates arbitrary file read as SYSTEM on all supported Windows versions running the September 2026 patches.
The researcher describes it as a "skeleton PoC" and says a full SYSTEM exploit may follow.
Switzerland Moves Away From Microsoft 365 to Open-Source Alternatives
More Details: https://t.co/qSPa2Yffh2
Switzerland’s federal administration is preparing to test a sovereign, open-source digital workplace that could reduce its long-term dependence on Microsoft 365 for sensitive government operations.
By the end of 2027, approximately 3,000 employees involved in particularly critical business processes are expected to have access to the sovereign platform.
The planned environment will provide core office capabilities, including email, calendars, document and presentation editing, telephony, file storage, collaboration tools, and audio and video conferencing.
#cybersecuritynews
This is the only site you need to actually get good at Docker.
It’ll put you way ahead of anyone just watching random Docker YouTube playlists.
And it’s completely free, with 11+ hours of hands-on content and exercises. 🐳
https://t.co/ZPl8qJUpoW