I'm definitely not disabling ASLR over this post, that would be utterly silly. I've been disabling ASLR for many years in the context of specific performance-se

I'm definitely not disabling ASLR over this post, that would be utterly silly. I've been disabling ASLR for many years in the context of specific performance-sensitive applications (mostly computational science stuff) in environments where the security concerns aren't relevant. ASLR does have a very real, measurable performance cost, but you're right in saying that it's fairly small and in most (though not all) cases you won't notice it. I am, however, very adamant that it should remain easy to disable. Any security-performance compromise must remain under developer control, because there is no globally optimal decision on when to make which tradeoff.