3 ms·

You must run a different branch of OpenBSD than I.

chasil 1y ago
In some defense of the parent post, a new kernel is relinked at every boot. This load is noticeable. This is aslr on steroids, and it does vastly increase kernel attack complexity, but it is a computational and I/O load that no version of Linux imposes that I know. Relinking the C library is relatively quick in comparison.
- sillywalk 1y ago
  > a new kernel is relinked at every boot Known as OpenBSD kernel address randomized link (KARL)[0][1] Also, libc, and libcrypto are re-linked at boot [2]. And sshd [3]. [0] https://marc.info/?l=openbsd-tech&m=149732026405941 https://marc.info/?l=openbsd-tech&m=149732026405941 [1] https://news.ycombinator.com/item?id=14709256 https://news.ycombinator.com/item?id=14709256 [2] https://news.ycombinator.com/item?id=14710180 https://news.ycombinator.com/item?id=14710180 [3] https://marc.info/?l=openbsd-cvs&m=167407459325339&w=2 https://marc.info/?l=openbsd-cvs&m=167407459325339&w=2
- rs_rs_rs_rs_rs 1y ago
  >aslr on steroids, and it does vastly increase kernel attack complexity That's quite the statement, in reality KARL is a mild incovenience at best(for a more sober look on it see https://isopenbsdsecu.re/mitigations/karl/ https://isopenbsdsecu.re/mitigations/karl/)
- daneel_w 1y ago
  > In some defense of the parent post, a new kernel is relinked at every boot. This load is noticeable. I can't say I agree with your implication that the load is significant. My anno 2020 low-power mobile Ryzen relinks the kernel in exactly 9 seconds. Shrug. It's entirely possible to disable at-boot kernel relinking if one prefers to, and settle for having the kernel relinked each time there's a patch for it.
  - chasil 1y ago
    I appreciate your quibble, but some people are using more modest equipment. Try a Raspberry Pi.
    - daneel_w 1y ago
      They're certainly not blazing, especially not if running on SD-based storage, which is horrifically slow at doing the intense small random writes this type of process entails. But this doesn't really say anything about OpenBSD, only about this type of hardware. It would after all fall equally short if you were to link the Linux kernel under Linux, or the FreeBSD kernel under FreeBSD, or start Chromium with two dozen tabs to be restored, etc.
      - chasil 1y ago
        A resizable ramdisk could address the I/O problem.

In some defense of the parent post, a new kernel is relinked at every boot. This load is noticeable. This is aslr on steroids, and it does vastly increase kernel attack complexity, but it is a computational and I/O load that no version of Linux imposes that I know. Relinking the C library is relatively quick in comparison.

sillywalk 1y ago
> a new kernel is relinked at every boot Known as OpenBSD kernel address randomized link (KARL)[0][1] Also, libc, and libcrypto are re-linked at boot [2]. And sshd [3]. [0] https://marc.info/?l=openbsd-tech&m=149732026405941 https://marc.info/?l=openbsd-tech&m=149732026405941 [1] https://news.ycombinator.com/item?id=14709256 https://news.ycombinator.com/item?id=14709256 [2] https://news.ycombinator.com/item?id=14710180 https://news.ycombinator.com/item?id=14710180 [3] https://marc.info/?l=openbsd-cvs&m=167407459325339&w=2 https://marc.info/?l=openbsd-cvs&m=167407459325339&w=2
rs_rs_rs_rs_rs 1y ago
>aslr on steroids, and it does vastly increase kernel attack complexity That's quite the statement, in reality KARL is a mild incovenience at best(for a more sober look on it see https://isopenbsdsecu.re/mitigations/karl/ https://isopenbsdsecu.re/mitigations/karl/)
daneel_w 1y ago
> In some defense of the parent post, a new kernel is relinked at every boot. This load is noticeable. I can't say I agree with your implication that the load is significant. My anno 2020 low-power mobile Ryzen relinks the kernel in exactly 9 seconds. Shrug. It's entirely possible to disable at-boot kernel relinking if one prefers to, and settle for having the kernel relinked each time there's a patch for it.
- chasil 1y ago
  I appreciate your quibble, but some people are using more modest equipment. Try a Raspberry Pi.
  - daneel_w 1y ago
    They're certainly not blazing, especially not if running on SD-based storage, which is horrifically slow at doing the intense small random writes this type of process entails. But this doesn't really say anything about OpenBSD, only about this type of hardware. It would after all fall equally short if you were to link the Linux kernel under Linux, or the FreeBSD kernel under FreeBSD, or start Chromium with two dozen tabs to be restored, etc.
    - chasil 1y ago
      A resizable ramdisk could address the I/O problem.