4 ms·
So do we know what the cause of the 500 ms slowdown was? It seems crazy to me that they spend so much time keeping this hidden and then never check for perform
by spacemanspiff01 2y ago
So do we know what the cause of the 500 ms slowdown was?
It seems crazy to me that they spend so much time keeping this hidden and then never check for performance degradation.
- glandium 2y agoAIUI, it was the dynamic loader audit hook checking symbol names against strings stored in a trie as a way to hide them. Tons of symbols, and slow process for each one.
- thelastparadise 2y agoAIUI?
- dustypotato 2y agoAs I Understand I ? (First time i seethis abbreviation)
- malaya_zemlya 2y agoAs I Understand It
- aiiotnoodle 2y agoThe postgres developer had disabled a bunch of optimization in order to create a low noise floor on his test machine that increased the delay too. Normally it would be much quicker but potentially could have been picked up downstream by other developers when the code became more mainstream. He did an interview for Risky Business #743.
- xyst 2y agoMy working theory is they got sloppy. A patch was ready to be introduced into Linux to prevent this type of attack (dynamically loading unneeded libraries). They were rushing to get it out into the wild and thus made many mistakes, including the performance degradation. From what I recall, some distros were reporting build errors in bleeding edge versions. Actors were essentially debugging issues in production, and recommending to distro maintainers ways to “fix” (really hide) the build issue with xz
- EasyMark 2y agoI've worked on long projects for a while, you can be relatively invisible for a year and let them know you're getting close (meaning a couple months) and the management will freak out and want it yesterday if it's near the end of a quarter and they think it will look good on quarterly reports. I assume the same can happen with government actors and "security companies".