3 ms·

Security is a process not a product. Reduce your attack surface and practice defense in depth. Once you know how it is a small investment of time to compile a

Security is a process not a product. Reduce your attack surface and practice defense in depth. Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. On any modern machine, just disable swap. It's not useful unless you want to suspend on mobile.

deleted 3y ago
[deleted]
5e92cb50239222b 3y ago
It is useful, unless you have an absolute crapton of memory, several times what you actually need. The swap is trivial to encrypt if you're paranoid (the key doesn't need to be persisted and can be generated from /dev/urandom on each boot). https://chrisdown.name/2019/07/18/linux-memory-management-at-scale.html https://chrisdown.name/2019/07/18/linux-memory-management-at... https://haydenjames.io/linux-performance-almost-always-add-swap-space/ https://haydenjames.io/linux-performance-almost-always-add-s... https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption
- contingencies 3y ago
  absolute crapton of memory, several times what you actually need Err, you mean every rack-mount system since around 2000s? Seriously, the commissioning overhead for virtually anything exceeds the "max out the ram" tax. Unless you're a cloud provider commissioning autonomously and operating at excessive scale seeking some particular unit cost optimization ... and even then not maxing out RAM (to some current definition of effective price:performance maxima) would be odd.
zokier 3y ago
> Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. Having timely zero-effort updates from distros is far, far more valuable for security than the reduction of attack surface from custom kernel.
- contingencies 3y ago
  That's highly dependent on circumstance, and not usually the case. How many remote 0-days were patched in Linux recently? How many local privilege escalations? How many of those subsystems can already be totally removed for a known workload? At the pointy end, you can be more bleeding edge compiling your own vs. waiting for distro releases. In the "I care enough to break from the crowd and own my own infrastructure" class of situation, this is not unheard of.
pluto_modadic 3y ago
"security is a process not a product". YES. (same with thinking you can just buy XYZ DevOps product and you're suddenly going to be "agile") ...at the same time I'm annoyed by the lack of quality and care in most products. Security products having pre-auth RCEs and other dumb things are really annoying.

deleted 3y ago

[deleted]

5e92cb50239222b 3y ago

It is useful, unless you have an absolute crapton of memory, several times what you actually need. The swap is trivial to encrypt if you're paranoid (the key doesn't need to be persisted and can be generated from /dev/urandom on each boot). https://chrisdown.name/2019/07/18/linux-memory-management-at-scale.html https://chrisdown.name/2019/07/18/linux-memory-management-at... https://haydenjames.io/linux-performance-almost-always-add-swap-space/ https://haydenjames.io/linux-performance-almost-always-add-s... https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption

contingencies 3y ago
absolute crapton of memory, several times what you actually need Err, you mean every rack-mount system since around 2000s? Seriously, the commissioning overhead for virtually anything exceeds the "max out the ram" tax. Unless you're a cloud provider commissioning autonomously and operating at excessive scale seeking some particular unit cost optimization ... and even then not maxing out RAM (to some current definition of effective price:performance maxima) would be odd.

zokier 3y ago

> Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. Having timely zero-effort updates from distros is far, far more valuable for security than the reduction of attack surface from custom kernel.

contingencies 3y ago
That's highly dependent on circumstance, and not usually the case. How many remote 0-days were patched in Linux recently? How many local privilege escalations? How many of those subsystems can already be totally removed for a known workload? At the pointy end, you can be more bleeding edge compiling your own vs. waiting for distro releases. In the "I care enough to break from the crowd and own my own infrastructure" class of situation, this is not unheard of.

pluto_modadic 3y ago

"security is a process not a product". YES. (same with thinking you can just buy XYZ DevOps product and you're suddenly going to be "agile") ...at the same time I'm annoyed by the lack of quality and care in most products. Security products having pre-auth RCEs and other dumb things are really annoying.