Melissa Kilby

> Hey @incertum, I'm honestly not quite sure why this PR was not merged when it was opened 3 years ago. I'm no longer actively involved with the project, so...

Quoting @erthalion > I think everyone agrees that working on sys_enter/sys_exit level might be too broad for some use cases, and having more flexibility around this is positive for the...

Great @FedeDP -- @erthalion and @Molter73 what are concrete next steps based on the WIP PR that is already open?

Thanks @erthalion and @Stringy! Thinking more about it: Could we open a proposal re the bigger vision of driver extensions and customizations? Let me post some more ideas re how...

Reread all comments and in addition to opening a new "vote" issue I also posted some concrete suggestions in the draft PR https://github.com/falcosecurity/libs/pull/1375#issuecomment-1833207329 --- Addressing a follow-up concern raised by...

> I'm catching up, but would the custom bpf programs still create events that are identical to the events created by the bpf program that attaches to sys_enter/sys_exit? Or do...

> > > I'm catching up, but would the custom bpf programs still create events that are identical to the events created by the bpf program that attaches to sys_enter/sys_exit?...

Amazing :heart: and fully on board with all proposed changes! Thanks a bunch for taking care of this!

+1 re "Separation of concern, least privilege, and other best practices" CC @sgaist, ty!

/milestone TBD /assign @jasondellaluce