Kernel, Antivirus, and EDR Explained: Why Your Computer Is Basically a City

This month, Fuckup Almanac Vol. 1 got a German passport. It’s out from dpunkt/O’Reilly as F*ckups: Von Fehlern, Fails und fragilen Systemen, and it’s not just the same book with longer words.

Every joke was localized for German realities, because a punchline built on American pop culture lands in Munich about as well as a Windows update on a Friday afternoon. My translator also kept asking what exactly I meant by certain terms, which is how I learned that several things I considered obvious were obvious mostly to me. Those now have footnotes. A couple of stories got updated too, because the world kept failing after the book went to print. Rude, but on brand. The structure got slightly flattened along the way, but the content is the same: same disasters, same explainers, same body count.

And the biggest change: the German edition lives under the O’Reilly imprint, famous for its animal covers. So the rubber ducks had to make way for a dodo. Given the subject matter, an extinct bird is probably the more honest mascot. More on that at the end.

To celebrate, I’m sharing one of the explainers from Vol. 1. Relax, it won’t be in German. Quick context for those who haven’t read the Almanac: every chapter is built around real IT disasters, and whenever the technology behind one needs explaining, I stop the story and explain it like a human, not like a vendor whitepaper. This one covers the software that is supposed to protect your computer, and why it’s also perfectly positioned to destroy it.

Explainer: When the Watchdogs Go Rogue — Kernel, Antivirus, and EDR

Imagine your computer as a city.

Not a flashy cyberpunk metropolis with flying cars, but a regular, busy place — streets, houses, utilities, grumpy residents, and a few shady bars where strange processes hang out at night.

At the center of it all is the Kernel — the city hall, the government, the one place that decides who gets access to what. The kernel doesn’t build houses or deliver mail itself; instead, it coordinates the city’s essential services. It keeps the water running (I/O), ensures power and heating (CPU and resources) reach everyone, and stops your neighbor from building a swimming pool on your plot (process isolation).

Think of memory as city land — the plots, courtyards, and backyards where residents build their houses and store their stuff. The kernel allocates these parcels, making sure nobody starts expanding over someone else’s fence. And if a resident overstays? The kernel evicts them—sometimes mid-party, leaving digital debris everywhere (process termination). It’s valuable real estate, and the kernel acts as zoning authority and land registry in one.

In short: it governs who can do what, and where.

Every application — your browser, text editor, or music player — lives in the city as an ordinary resident. They operate in the user space, a polite suburb where everyone minds their own business (mostly). Each resident can use public infrastructure — read files, connect to the internet, play sounds — but only by asking permission from the city hall. The kernel decides what’s allowed and what’s not.

When the City Needs a Watchdog

Now, even in the best-run cities, not every resident behaves. Some throw wild parties (malware), some build secret tunnels (rootkits), and others start fires just for fun (ransomware). That’s where security services come in.

In the early days, this job belonged to the antivirus — think of it as the city’s first security guard, part police officer, part firefighter. Its job was simple: walk around with a list of known troublemakers (virus signatures) and arrest anyone matching the description. “Aha! You’re the ‘ILoveYou’ worm! You’re coming with me.”

It worked — until it didn’t. The criminals got creative. They changed disguises, altered behavior, and started committing crimes the guard had never seen before.

So, the antivirus had to evolve. Instead of just matching names on a list, it had to learn to recognize behavior based on general instructions. In the old days, it was enough to follow a rule like “don’t light a fire in the living room.” Today, the guard has to infer that lighting fires in the bedroom is probably also bad — and react to the mere sight of smoke before the flames even start. This shift is what we call heuristic or behavioral detection — a kind of intuition trained to see trouble coming.

Still, that only covered so much. The next generation arrived: EDR, or Endpoint Detection and Response. If the antivirus is your neighborhood cop, the EDR is a mix of detective, counterintelligence agency, and public health department.

An antivirus deals with individuals — it catches one infected resident and calls it a day. The EDR looks at the patterns. It investigates: Who’s talking to whom? Why is that office worker sending encrypted messages to strangers in another city at 3 a.m.? Are several employees simultaneously buying identical shovels and rope? Something’s up.

EDR tools don’t just patrol one block; they wire up CCTV across the city (telemetry collection) to spot gang activity before it escalates, tracking digital epidemics like a CDC for code, quarantining whole neighborhoods if a virus starts coughing. In other words, EDR tools don’t just stop attacks; they collect data for later investigation — detailed logs, timelines, and traces that let forensic teams retrace every suspicious move. If malware is a local crime, EDR handles organized conspiracies and builds the case file afterward.

And it doesn’t stop at one city. Zoom out: your computer is one city in a federation of devices. The EDR’s jurisdiction spans the whole nation — in this metaphor, that’s your corporate network. Each city (an endpoint — laptop, phone, or server) has its own local police, but the EDR connects them into a federal security service watching for coordinated threats across borders.

Why the Watchdogs Need Special Privileges

But every utopia has its underbelly: to spot misbehavior, these guardians need to see things others can’t. They must peek into everyone’s homes, check the wiring, and occasionally search through the trash. In the digital city, that means operating not in user space, but in kernel space — the secure district where the city’s core decisions are made.

It’s a bit like giving your security team the keys to every building in town. Necessary, yes — but risky. One bad command, and the whole city grid can go dark. These watchdogs operate with the authority of city hall itself — which means that if they screw up, it’s not just a local problem. The entire hierarchy is compromised.

It’s like the Watergate scandal of 1972: a few guys break into an office building to plant recording devices, but when the story comes out, it doesn’t just end with their arrest — the whole administration collapses. The trust chain breaks, and suddenly, chaos reigns.

The same thing happens inside a computer. Processes running in kernel space aren’t just privileged citizens — they are the system’s law enforcement. When they malfunction, there’s no higher authority — if the watchdog bites the mayor, there’s no one left to call animal control to correct them. One faulty driver or botched security update, and the city goes into full anarchy: lights out, sirens blaring, total collapse. The digital equivalent? A cheerful Blue Screen of Death on Windows, or a kernel panic’s cryptic poetry on other systems.

In the book, this explainer opens the story of the CrowdStrike outage of July 2024, when that is exactly what happened: the very watchdogs meant to protect the city started clubbing random bystanders and pulling the plug on the power plant.

In security, power and fragility go hand in hand. The kernel is the mayor, antivirus the patrol officer, and EDR the national security agency. But when any of them lose control, the result isn’t peace.

It’s chaos, with a blue screen.

The Duck, the Dodo, and the Rest of the Story

If you want the full story of how one faulty update grounded airlines and knocked hospitals offline, it’s in Fuckup Almanac Vol. 1, together with almost a hundred other ways systems die.

About that dodo. O’Reilly’s guidelines only required it on the cover. But a dodo outside and ducks inside felt like a half-finished migration, and I’ve read enough postmortems to know how those end. So every single illustration in the book got redrawn. If you want to see duck and dodo side by side, chapter by chapter, here’s the gallery.

If you read German, the new edition is here, and dpunkt has a free sample chapter if you’d like to test the waters first.

And if you don’t: no worries. The original English edition is still very much alive. Unlike most of the systems it describes.