-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Alan McKinnon: > On 20/02/2014 22:41, Nicolas Sebrecht wrote: >> On Thu, Feb 20, 2014 at 08:52:07PM +0400, Andrew Savchenko >> wrote: >> >>> And this point is one of the highest security benefits in real >>> world: one have non-standard binaries, not available in the >>> wild. Most exploits will fail on such binaries even if >>> vulnerability is still there. >> >> While excluding few security issues by compiling less code is >> possible, believing that "non-standard binaries" (in the sense of >> "compiled for with local compilation flags") gives more security >> is a dangerous dream. >> > > > +1 > > "non-standard binaries" is really just a special form of security > by obscurity.
So you are saying compiling a minimal kernel to minimize exposure to subsystem bugs is only obscurity? (I really wonder what Greg would say to this) The argument that this particular setup may be less tested is a valid one. But less tested also means less commonly known exploits and testing these setups is a win-win for users and upstream. Whether you like it or not... whenever you install software on a server, you become a tester at the same point. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJTB19lAAoJEFpvPKfnPDWzxR0H/1sz9v/yvAS/EvdCUgo6MBYW 0+A1yJPNfDK3eNMtcipcfBLIs2PbxjamtXKI/Ysjbog3oJxrt1cczDlLByGgG2kW PM0buUKsId6eLM/X3X9UJ06ZCVIK4JN4Baf9OAaBdJrquwL1Ja7rfzjTbC7vEOWj 9H0UqHuVL6qgvUvyVodMJWVXjc8Deda5w+Z9bWAbeBncf/pDukOO0JWr/6/wUsNe fhdcDqijB+qZ3auHA7YYwpwIYTBIGdlHRUwqm9zVDbSnOQm79FLE/3+dsaAjTqv/ NmXvsAmggHb1Q6FpMwZmaXHCtTMN67zWRaE+Oi36p7p7gZK/1DyW8lwgqBsq5/M= =ZQID -----END PGP SIGNATURE-----
