Windows kernel praised to the skies
Windows Kernel Praised to the Skies? The One Saying It Works for Google, and It's Linux Fans Who Are Furious. Windows and Linux have been fighting for over thirty years, but this time the person speaking up for Windows is a bit unusual. Laurie Kirk spent four years as a reverse engineer at Microsoft, jumped to Google in 2024, and runs the YouTube channel LaurieWire.
💡 What You Will Learn
Windows Kernel Praised to the Skies? The One Saying It Works for Google, and It's Linux Fans Who Are Furious. Windows and Linux have been fighting for over thirty years, but this time the person speak
📜 Table of Contents
Is the Windows Kernel Overhyped? The One Saying So Works at Google, and It's Linux Fans Who Are Furious
Windows and Linux have been fighting for over thirty years, but this time the person speaking up for Windows is a bit unusual.
Laurie Kirk spent four years as a reverse engineer at Microsoft, jumped to Google in 2024, and her YouTube channel LaurieWired has over 500,000 subscribers. On September 26, she posted the same take on X and LinkedIn: "The NT kernel really is an engineering marvel, and in many ways still puts Linux to shame." When someone asked her how she could judge a closed-source kernel, she replied, "Maybe because I worked there."
The NT Kernel Is Like an Object-Oriented Language
This story starts in 1988. Microsoft poached Dave Cutler, DEC's legendary engineer. He brought a bunch of his old subordinates along, spent the first half year writing specs before touching any code, and delivered NT 3.1 in 1993. In this kernel, processes, threads, files, devices, registry keys, access tokens — they're all objects, more than 25 kinds in total, all created, destroyed, and accounted for by a single "Object Manager." What a program gets is a Handle. Permissions are locked in the moment it's opened. Duplicating a handle can only reduce privileges, never add them, and every single access can be checked against the audit log.
Kirk thinks Linux is stitched together in this area: user IDs, groups, ACLs, namespaces, cgroups, SELinux — each managing its own patch of turf, most of it bolted on after the fact. SELinux wasn't submitted by the NSA until 2001, and the kernel didn't adopt the LSM framework until 2003. One was designed properly from day one, the other has been patched for thirty years — that's her core argument.
Along Comes AI Agents, and the Question Changes
What Kirk really wants to talk about is 2026. She boils the question down to one line: what exactly is this AI agent allowed to do?
When an admin clicks through things step by step, you can trace what happened after something goes wrong. An AI agent can run thousands of commands in minutes, execute code it just wrote itself, and chain permissions together — all without asking anyone along the way. She argues that NT's typed resources plus centralized auditing are naturally suited to answering "what did the agent actually do when it went haywire."
She also floated a thought experiment: if Microsoft had launched an "Open NT" in the 2000s, letting giants like Amazon modify the scheduler and memory allocator while Microsoft held the security floor, would today's server market look completely different? Veteran Linux developer David Airlie shot that down in one line: you can't afford the forks. Change NT's scheduler, and every monthly security patch afterward has to be re-merged and re-tested. Twenty years later, you've got a second kernel team.
Linux Is Catching Up Too
That said, Linux hasn't just been sitting there taking hits. Landlock, merged into the kernel in 2021, lets ordinary processes restrict their own file and network access. Rules are passed down to child processes, can only tighten and never loosen, and denied operations go to the audit log by default. Microsoft's own documentation admits that namespaces weren't designed for access control — which kind of confirms Kirk's point from the side.
Another fact needs to be put on the table: today's NT kernel is generations removed from the 1993 version. NT 4.0 shoved graphics drivers into the kernel for performance, and one bad driver could blue-screen the whole machine. What Kirk is praising is the design philosophy from back then — everything piled on afterward is a separate matter.
Microsoft Is Already Making Moves
At this year's Build conference, Microsoft announced Microsoft Execution Containers (MXC): developers declare what an agent can touch, the system enforces it at runtime, each agent gets its own account, and every action is traceable. Windows 11's Agent Workspace also uses ACLs to keep agent accounts confined within user privileges. Under the hood, this whole thing runs on objects, tokens, and ACLs — exactly the design Kirk was praising.
Objects and handles have been running for 33 years. They didn't get open-sourced, but they did get AI. Objects and handles have been running for 33 years. They didn't get open-sourced, but they did get AI. So in the AI era, are you more on team Windows or team Linux?
Written by our editorial team; tools listed here are tested or verified against public sources. Links point to official sites or GitHub repos for reference only — no paid placements.