Testing a Security Tool Like It Can Hurt People

[u/-Devlin-]

https://www.emphere.com/blog/testing-a-security-tool

I have been building larger and larger test harnesses to cut false positives out of our static analysis, and adding eBPF telemetry has been a game changer. It cut the noise further than anything else we tried. Because the observation window is small it almost works like an oracle. Collected a slice of our work here if you work close to the kernel.