A Google researcher, Laurie Kirk, who previously spent four years as a reverse engineer at Microsoft, has reignited a long-standing debate in the tech community regarding the merits of the Windows NT kernel compared to Linux. Kirk, now at Google and the host of the popular LaurieWired YouTube channel, boldly asserts that the NT kernel is an engineering marvel that surpasses Linux in several respects. In her recent posts on social media platforms X and LinkedIn, she stated, “the NT kernel really is an engineering marvel that still puts Linux to shame in many ways.”
Kirk’s focus is on the architecture of Windows NT, particularly how it manages resources and access permissions. She emphasizes that her critique is not about the user interface of Windows 11 or its various features but rather about the underlying system architecture. Looking ahead to 2026, she poses a critical question: whether Linux is well-suited for AI agents that are increasingly granted more permissions. She even speculates on an alternate reality where Microsoft had released an “Open NT” that could have been forked by companies like Amazon.
As expected, Kirk’s remarks have drawn a mix of admiration and skepticism from seasoned engineers in the field. Many have defended Linux’s modular design, arguing that the ability to fork the OS is a fundamental strength rather than a weakness. They contend that any attempt to create an “Open NT” would likely lead to fragmentation and maintenance challenges.
Remember, Laurie Kirk is praising the NT kernel under Windows, not Windows 11
The NT kernel has been the backbone of all major Windows releases since its inception in 1993, including Windows 11. Microsoft’s decision to hire Dave Cutler in 1988, who previously led VMS development at DEC, was pivotal. His team spent considerable time on the initial specifications, aiming for portability, multiprocessor support, and security certification.
Dave Plummer, a retired Microsoft engineer known for his work on Task Manager, remarked, “NT wasn’t Dave Cutler’s first rodeo, and it shows in how forward-looking it was and is.” He noted that this was Cutler’s third attempt at crafting a kernel from scratch, following his experiences with RSX-11M and VMS.
However, it is essential to clarify that NT is not merely a rebranded version of VMS. Initially conceived as NT OS/2, it was designed to be a portable operating system for Intel’s i860 chip before transitioning to MIPS architecture. The shift in focus from OS/2 to Win32 came after the impressive sales of Windows 3.1, which sold 16 million copies in just six months.
Franco Minucci, an SoC engineer at Nokia, pointed out that the issues surrounding Windows 11 are more related to its user interface than the kernel itself. Much of the criticism directed at Windows 11 stems from its integration of AI features, which have not always met user expectations. Despite these challenges, Microsoft has made significant strides in enhancing its Copilot features, which CEO Satya Nadella has described as an operating system for work.
When questioned about her ability to critique a closed-source kernel, Kirk confidently replied, “maybe because I used to work there…”, reminding her audience of her four-year tenure at Microsoft.
Windows NT is object-based, which is what Kirk means by object-oriented
Kirk succinctly describes NT as being “more like an object-oriented language, with a strong security model from day one, whereas Linux is very…not.” While Microsoft does not classify Windows as object-oriented in the traditional C++ sense, it refers to it as object-based.
In the NT architecture, various elements—processes, threads, files, devices, registry keys, mutexes, jobs, and access tokens—are treated as objects, with over 25 object types in total. The Object Manager is responsible for creating and managing these objects, maintaining their namespaces, and tracking access rights. This design allows for internal modifications without disrupting other components, a feature that many developers find appealing.
When an application opens a file, Windows provides a handle that encapsulates the granted rights, ensuring that subsequent requests are validated against those rights. This consistent model for resource management is often viewed as a hallmark of elegance in Kirk’s assessment.
NT’s security model was designed around resources, identities, and permissions
Microsoft’s documentation outlines a security model that emphasizes per-object rights, supplemented by a few system-wide privileges. Upon signing in, Windows generates an access token that contains the user’s security identifier (SID), group memberships, and privileges, which is then replicated for every process initiated by the user. Each securable object is equipped with a security descriptor that includes access control lists (ACLs) to specify which SIDs are granted or denied particular rights.
However, a robust security model does not inherently guarantee a secure operating system. Although NT 3.5 achieved a C2 security rating in 1995, it did so under specific conditions that limited networking capabilities and tightened default permissions. Ken C., an infrastructure engineer with experience at Bloomberg and Reuters, challenged Kirk to identify any other product that necessitates monthly updates to avoid security vulnerabilities.
Linux’s security model is more complicated, but it isn’t necessarily a flaw
Kirk also critiques Linux’s security framework, questioning its complexity. She asks, “Do you use UIDs? GIDs? ACLs? CGROUPs? Policies? SELinux? Filesystem modes?”, arguing that there is no “singular coherent graph of capabilities.”
Each component of Linux’s security model serves a distinct purpose. UIDs and GIDs identify users and groups, while file modes and ACLs protect files. Capabilities allow for the delegation of root privileges, enabling processes like web servers to operate without full root access. Namespaces provide isolated views of system resources, and cgroups manage resource allocation. Although Kirk is correct that many of these features were introduced later in Linux’s development, the kernel’s design philosophy embraces modularity and flexibility.
Ken C. argues that this add-on model is a defining characteristic of Unix and Linux, emphasizing the importance of community collaboration in maintaining the architecture. Kevin Faulkner added that the optional nature of SELinux allows high-performance computing projects to bypass unnecessary overhead.
AI agents are why Kirk thinks Linux is a poor fit in 2026
Kirk raises a critical point regarding the future of operating systems in the context of AI. She succinctly states, “What exactly is this AI agent allowed to do?” The traditional model of user interaction, where an admin approves actions one at a time, contrasts sharply with the capabilities of AI agents, which can execute numerous actions in rapid succession, often without explicit permission.
Kirk believes that NT’s architecture can adapt to support explicitly typed resources and provide robust centralized audit trails, which would be essential if an AI agent were to malfunction. While Linux has made strides with features like Landlock, which allows even unprivileged processes to restrict their own access, Kirk argues that the lack of a cohesive framework may hinder its effectiveness in managing AI agents.
Microsoft is also exploring this challenge. At Build 2026, the company introduced Microsoft Execution Containers (MXC), which enable developers to define the permissions of an agent at runtime. This approach aligns with Kirk’s vision of a more controlled environment for AI agents, leveraging NT’s existing security model.
“Open NT” is the alternate history Laurie Kirk wishes Microsoft had written
Kirk expresses a desire for Microsoft to have created an “Open NT” in the early 2000s, not in a fully GPL-style manner, but rather as a platform that would allow organizations to customize components like memory allocators. She imagines a scenario where an early version of Amazon could have developed “AmazonNT” for its EC2 services, complete with tailored scheduling and networking capabilities.
While she acknowledges that Microsoft made some attempts at openness through initiatives like the Shared Source Initiative, which provided access to Windows source code for select enterprises and educational institutions, she argues that these efforts fell short of allowing for true commercial forks.
Linux’s biggest counterargument to Open NT is the cost of forks
David Airlie, a veteran Linux kernel developer, counters Kirk’s vision by highlighting the impracticalities of maintaining forks over time. He asserts, “Forks don’t work like that. Too expensive over time to maintain.” He challenges Kirk to consider the long-term implications of sustaining a fork of NT’s memory manager without a revenue model.
Kirk points to Java as an example where multiple implementations coexist, but Airlie counters that those projects have paying customers to support their development. He notes that many forks of Linux have emerged only to fade away due to the financial burden of ongoing maintenance.
NT has its own baggage, and critics are right to bring it up
Critics like Ken C. have raised valid concerns about NT’s performance and reliability, questioning how to achieve deterministic performance without overspending on hardware. Others have pointed out that certain design decisions, such as moving graphics drivers into kernel space, have historically led to stability issues.
It’s important to note that the NT kernel in Windows 11 is not a static relic of its 1993 origins. Kirk’s praise for NT’s foundational principles must be viewed in the context of the evolution and complexities that have arisen over the years.
Linux’s success is the strongest argument against the NT alternate history
Linux has established itself as the dominant force in servers and cloud computing, largely due to its open-source nature, which allows for modification and collaboration. Developers have cited its efficiency and control as key advantages, while others have pointed to its stability under high loads.
Interestingly, Microsoft has been making efforts to enhance Windows as a platform for Linux, with Ubuntu gaining traction on Windows 11 and the Windows Subsystem for Linux (WSL) improving in performance and functionality. This shift indicates a recognition of Linux’s strengths and a desire to integrate those capabilities into the Windows ecosystem.
What Windows could learn from BSD?
Kirk suggests that a future kernel might resemble NT or even a BSD fork, noting that BSD offers a more streamlined architecture with fewer overlapping capabilities. She commends BSD’s early adoption of jails for process isolation and highlights the potential of capability-based security.
The real question is what an operating system should make easy in 2026 and forward
As the landscape of computing evolves, the fundamental question shifts from user identity to the permissions and capabilities of software agents. NT’s design emphasizes defined resource types and centralized auditing, while Linux offers a flexible, composable approach. Both systems have their strengths and weaknesses, and as AI continues to shape the future of technology, the need for clear frameworks governing agent behavior becomes increasingly critical.
While Kirk’s vision of an “Open NT” may remain a speculative fantasy, the ongoing dialogue surrounding the capabilities and limitations of operating systems will undoubtedly influence the development of future technologies.
