The non-zero performance impact on ASLR is basically 0, and impacts link-time performance more than anything else, which most devs should not care about. So bef

The non-zero performance impact on ASLR is basically 0, and impacts link-time performance more than anything else, which most devs should not care about. So before you start going for the tiniest of microoptimizations maybe profile. Yes, there is absolutely reason to use ASLR. This attack assumes that an attacker can get the target program to eval arbitrary code. This is not something most programs do. If you are remotely exploiting a vulnerable SSH, or some service, this attack provides nothing to you. ASLR is still very effective for this use case. This is why I find this paper so frustrating.