Keeping the Windows eBPF in userland seems to be a contradiction in terms, but marrying it with a kernel driver and a secure sandbox gives you the security you need with the flexibility you want.

Triplett is an advocate of using Rust for systems-level programming and as a replacement for C, which has been widely used at Microsoft for Windows and within the Linux kernel.