Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You must run a different branch of OpenBSD than I.


In some defense of the parent post, a new kernel is relinked at every boot. This load is noticeable.

This is aslr on steroids, and it does vastly increase kernel attack complexity, but it is a computational and I/O load that no version of Linux imposes that I know.

Relinking the C library is relatively quick in comparison.


> a new kernel is relinked at every boot

Known as OpenBSD kernel address randomized link (KARL)[0][1]

Also, libc, and libcrypto are re-linked at boot [2].

And sshd [3].

[0] https://marc.info/?l=openbsd-tech&m=149732026405941

[1] https://news.ycombinator.com/item?id=14709256

[2] https://news.ycombinator.com/item?id=14710180

[3] https://marc.info/?l=openbsd-cvs&m=167407459325339&w=2


> In some defense of the parent post, a new kernel is relinked at every boot. This load is noticeable.

I can't say I agree with your implication that the load is significant. My anno 2020 low-power mobile Ryzen relinks the kernel in exactly 9 seconds. Shrug.

It's entirely possible to disable at-boot kernel relinking if one prefers to, and settle for having the kernel relinked each time there's a patch for it.


I appreciate your quibble, but some people are using more modest equipment.

Try a Raspberry Pi.


They're certainly not blazing, especially not if running on SD-based storage, which is horrifically slow at doing the intense small random writes this type of process entails. But this doesn't really say anything about OpenBSD, only about this type of hardware. It would after all fall equally short if you were to link the Linux kernel under Linux, or the FreeBSD kernel under FreeBSD, or start Chromium with two dozen tabs to be restored, etc.


A resizable ramdisk could address the I/O problem.


>aslr on steroids, and it does vastly increase kernel attack complexity

That's quite the statement, in reality KARL is a mild incovenience at best(for a more sober look on it see https://isopenbsdsecu.re/mitigations/karl/)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: