March 26, 2026
Parens in your kernel?!
Whistler: Live eBPF Programming from the Common Lisp REPL
Write kernel tricks live from Lisp — fans thrilled, one calls the blog “AI slop”
TLDR: A new tool called Whistler lets people write and run tiny kernel-watching programs live from a Lisp prompt, skipping the usual complex setup. Commenters cheered the feat and joked about “parentheses in the kernel,” while one called out the post’s AI-written explainer as “slop,” sparking a mini culture war.
Common Lisp just crashed the cool kids’ table, and the crowd is losing it. Whistler lets developers write tiny programs that run inside the Linux kernel — the part of the system that does the heavy lifting — and do it live from a Lisp prompt. No heavy toolchain, no files on disk, just type a few parentheses and watch your machine spill the beans in real time. The demo? Counting every program launch on your system, then tracing how apps call into a shared library. Geek poetry.
But the comments stole the show. One fan basically yelled “take my weekend,” warning they’re “in danger of being nerd sniped.” Another voice threw shade at the blog post’s “why this matters” section, calling it clearly AI-written and giving off “slop” vibes. And that sparked the side drama: a classic split between people hyped about the engineering flex and people rolling their eyes at AI fluff wedged into a very human, very clever hack.
Jokes flew fast: “Parentheses have entered the kernel,” “Is this Emacs with root?” and “Live-coding your OS like a DJ set.” The vibe is equal parts admiration and meme-fest — with a petty squabble about AI copywriting simmering in the background. Whistler wowed; the commentariat brought the popcorn.
Key Points
- •Whistler is a Common Lisp-based DSL and optimizing compiler for eBPF.
- •It produces ELF eBPF object code directly, bypassing the clang/LLVM toolchain.
- •Whistler supports inline compilation and live loading/unloading from the Common Lisp REPL without writing object files to disk.
- •A kprobe example counts execve calls, with bytecode generated at macroexpansion and embedded in the Lisp expansion.
- •A uprobe example traces libffi’s ffi_call, aggregating counts by process and signature within a single SBCL process.