3 ms·
The number of defenses is pretty impressive. The number of out-of-tree and commercial defenses is also impressive. The amount dedicated to specifics of C (UB, b
by nine_k 2y ago
The number of defenses is pretty impressive. The number of out-of-tree and commercial defenses is also impressive. The amount dedicated to specifics of C (UB, bounds checks, use-after-free) is relatively small.
It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features.
- zie 2y ago> It would be interesting to compare to, say, OpenBSD, with its apparently numerous security and defense-in-depth features. I'm not sure that would be a very fair comparison. A lot of OpenBSD security comes from just skipping giant swaths of stuff. Advanced filesystems are non-existent, Bluetooth is non-existent, etc. I haven't done a count lately, but I would guess the Linux Kernel alone is larger than the OpenBSD base system. It's simplicity is a huge security feature. Provided you don't need some of those features. I'm not saying this as an OpenBSD hater or anything, I run OpenBSD on at least one machine.