Re:The status of Linux kernel hardening
by rasz_pl on Thursday November 10, 2016 @04:05AM
(#12918841)
Most(except ro/no exec) of the stuff mentioned are poor band-aid after the fact just in case security by obscurity solutions :( Whats worse some of them add baggage of kludges and cost extra processing, all in the name of slowing down attacker (not stopping, slowing down). This is why Linus was mostly skeptical if not opposing this (and grsec).
[ Parent
| on HN ]
And all of them are band-aid for keeping to use monolith OSes written in C.
Re:The status of Linux kernel hardening
by viraptor on Thursday November 10, 2016 @04:48AM
(#12919049)
I'd still add overflow protection to the good changes. If there's a counting logic error, there's not much you can do apart from locking down access to the resource. Provided you're already using a language that doesn't prevent it of course.