News for hackers. Stuff that matters.

A comment on SSHD: Random boot time relinking, OpenBSD. Parent comment

Re:SSHD: Random boot time relinking, OpenBSD by codesniperjoe on Friday January 20, 2023 @10:00AM (#34453985)
Yes, the base idea is not that new. I store since years every GO based application I use as small (few kb) source code tree checkout only, no binary at all. At runtime the wrapper compiles a randomized individual one-time-temporary-uniq binary via garble [0].

[0] https://github.com/burrowers/garble

[ Parent | on HN ]
Re:SSHD: Random boot time relinking, OpenBSD by okl on Friday January 20, 2023 @03:02PM (#34458983)
How do you ensure that your compiler and libs are clean though?
[ Parent | on HN ]
Re:SSHD: Random boot time relinking, OpenBSD by codesniperjoe on Friday January 20, 2023 @11:12PM (#34463808)
The compiler (go) is part of a static read-only (compressed/in-memory) RootFS. Build on a air-gap build server, touching only signed/verified/reviewed code from git-offline mirror snaps. Go has no libs, all static. The resulting runtime only binaries are totally uniq/randomized and dependency free, straight from (signed) source code.
[ Parent | on HN ]