3 ms·

> Security and Kernel-size Oh yeah, since we care about security so much, let's have a whole fucking C compiler suite on every machine because what if we need

> Security and Kernel-size Oh yeah, since we care about security so much, let's have a whole fucking C compiler suite on every machine because what if we need to recompile the kernel to mitigate a potential problem that might not even be there!? If you really care that much, you delete the modules and run depmod. It's fast and you don't need to have a compiler on hand.

nix23 4y ago
You can configure "world" too, and you can compile your kernel/world and packages from a jail or vm, with or without poudriere. But why so aggressive? No one attacks your substitute religion.
- WesolyKubeczek 4y ago
  I know, when you run out of any arguments of merit, you call the other side "aggressive". But the truth is, you have nothing to say. Okay, you can set up a whole container so you can recompile your kernel to your heart's delight. Fine. How does it scale? How do you distribute your new shiny kernel to hundreds of machines and keep track which is running which? What if you make a mistake, is it easy to roll back? How easy is it? Also, need I remind you that a world where you don't have to (but can if you really really want to) compile things to get the results you want is infinitely better than a world where you have to compile things?
  - nix23 4y ago
    >How do you distribute your new shiny kernel to hundreds Like you distribute a iso or a image, is that really so impossible for you? >How does it scale? As much as you want. >What if you make a mistake, is it easy to roll back? See you don't even know zfs or be's..or hell version's??...your a evangelist and i don't like them. >I know, when you run out of any arguments of merit Seams like you run out of arguments, again you can create your own image of freebsd without compiler, nfs, zfs whatever you want. But your are probably happy having the cruise-ship for the fishing side trip. Have fun with your religion.
1500100900 4y ago
You can disable building the "whole fucking C compiler suite" using WITHOUT_CLANG as documented in https://www.freebsd.org/cgi/man.cgi?query=src.conf https://www.freebsd.org/cgi/man.cgi?query=src.conf By the way, as an example, you can also disable IPv4 and IPv6 in the kernel, I'm not sure how to do it in Linux.
trasz 4y ago
Conflating a C compiler with security... Let me guess, you are some kind of old school script kiddie who believes security is improved by making it harder to compile a 0day? :-D

nix23 4y ago

You can configure "world" too, and you can compile your kernel/world and packages from a jail or vm, with or without poudriere. But why so aggressive? No one attacks your substitute religion.

WesolyKubeczek 4y ago
I know, when you run out of any arguments of merit, you call the other side "aggressive". But the truth is, you have nothing to say. Okay, you can set up a whole container so you can recompile your kernel to your heart's delight. Fine. How does it scale? How do you distribute your new shiny kernel to hundreds of machines and keep track which is running which? What if you make a mistake, is it easy to roll back? How easy is it? Also, need I remind you that a world where you don't have to (but can if you really really want to) compile things to get the results you want is infinitely better than a world where you have to compile things?
- nix23 4y ago
  >How do you distribute your new shiny kernel to hundreds Like you distribute a iso or a image, is that really so impossible for you? >How does it scale? As much as you want. >What if you make a mistake, is it easy to roll back? See you don't even know zfs or be's..or hell version's??...your a evangelist and i don't like them. >I know, when you run out of any arguments of merit Seams like you run out of arguments, again you can create your own image of freebsd without compiler, nfs, zfs whatever you want. But your are probably happy having the cruise-ship for the fishing side trip. Have fun with your religion.

1500100900 4y ago

You can disable building the "whole fucking C compiler suite" using WITHOUT_CLANG as documented in https://www.freebsd.org/cgi/man.cgi?query=src.conf https://www.freebsd.org/cgi/man.cgi?query=src.conf By the way, as an example, you can also disable IPv4 and IPv6 in the kernel, I'm not sure how to do it in Linux.

trasz 4y ago

Conflating a C compiler with security... Let me guess, you are some kind of old school script kiddie who believes security is improved by making it harder to compile a 0day? :-D