063 - What Is a Kernel, and Why Does It Blue Screen Your Server?

The kernel is just software. It happens to be the one program on the box with no guardrails, which is why one bad driver takes the whole system down with it. Andy Syrewicze and Eric Siron walk the kernel from the bottom up: why running two programs at once needed a supervisor, how user mode and kernel mode split the work, and where IRQs, drivers, and the HAL fit. Andy strips a Gentoo kernel so thin it cannot find its own hard drive, and Eric argues a blue screen is the kernel protecting your data. Then they weigh whether Microsoft should push third-party code out of kernel space after CrowdStrike. Up front: Microsoft deleting nonprofit tenant data early, and a listener choosing between Network+ and the server certs. Chapters: 00:00:00 - Cold Open: Kernels Are Not Magic 00:01:33 - Welcome and Show Plugs 00:05:05 - News React: Local AI and the Surface Laptop Ultra 00:07:47 - Anthropic, Bot Swarms, and the Local Model Threat 00:10:57 - Can You Trust the No-Training Checkbox? 00:14:05 - News React: Microsoft 365 Family Storage Cut 00:14:46 - Microsoft Deletes Nonprofit Data Early 00:17:33 - The Cloud Trust Problem 00:19:10 - Retention Is Not Backup 00:21:12 - Listener Question: Help Desk to Junior SysAdmin 00:23:51 - Get the Certs for the Job You Want 00:27:06 - Get the Job First, Then the Certs 00:30:44 - Is Security+ Worth It for a Generalist? 00:32:15 - Main Topic: What a Kernel Actually Is 00:33:54 - From One Program at a Time to Many 00:35:25 - Hand-Written Drivers and the Video Card Virus 00:36:05 - The HAL Ended a Whole Category of Attacks 00:37:29 - Where the Word Kernel Comes From 00:39:02 - Mandrake, Debian, and Gentoo 00:40:48 - Kernel Mode vs User Mode 00:42:48 - Before Memory Protection: DOS to Virtual Memory 00:45:14 - Kernel Mode Drivers Run Without Guardrails 00:45:51 - IRQs, TIE Fighter, and Windows 3.1 00:46:58 - A 2026 Kernel Bug That Fought Over an IRQ 00:49:56 - Install Gentoo Once to Learn the Kernel 00:52:44 - Andy's Razor-Thin Kernel Panic 00:54:14 - ARC Paths and NT Boot Failures 00:57:06 - What Happens When Kernel Code Misbehaves 00:57:51 - CrowdStrike and the Botched Kernel Update 00:58:39 - Why the Blue Screen Is the Right Call 01:01:32 - Should Microsoft Lock Down Kernel Access? 01:02:44 - Wrap Up and Outro Resources / Show Notes: - SysAdmin Weekly 036 - The Hidden Cost of Abstraction: https://youtu.be/5ic4Pozot44 - Eric Siron - Kernels, Shells, and Operating Systems (Re)Visited: https://projectrunspace.org/kernels-shells-and-operating-systems-revisited/ - Microsoft Learn - User mode and kernel mode: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode - Gentoo Handbook - Configuring the Linux kernel: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Kernel - Microsoft - CrowdStrike outage response: https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/ - Microsoft - The Windows Resiliency Initiative: https://blogs.windows.com/windowsexperience/2025/06/26/the-windows-resiliency-initiative-building-resilience-for-a-future-ready-enterprise/ - PCWorld - Surface Laptop Ultra and local AI: https://www.pcworld.com/article/3255200/the-surface-laptop-ultra-is-an-ai-monster-with-a-laptop-problem.html - The Register - Microsoft deletes nonprofit M365 data: https://www.theregister.com/saas/2026/09/28/microsoft-tells-nonprofits-their-deleted-m365-data-isnt-coming-back/5299433 - SysAdmin Weekly: https://www.sysadminweekly.com - SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com - AndyOnTech: https://www.andyontech.com - Project Runspace: https://www.projectrunspace.org - GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions