Re: Attempts at security
On Sunday 04 February 2007 01:20, Henrique de Moraes Holschuh <hmh@debian.org>
wrote:
> On Sat, 03 Feb 2007, Russell Coker wrote:
> > One that springs to mind is CONFIG_HIGHMEM4G, it seems only useful if you
> > have
>
> You need to enable PAE (64GB support) to access the NX bit on ia32, which
> is even worse, and that's the reason why my 1GB laptop has a PAE kernel :(
My impression (after a quick google search) is that only applies when running
a 32bit kernel on a 64bit CPU. Best to just run an AMD64 kernel and have NX
without any problems.
As an AMD64 kernel runs 32bit binaries, if you want a 32bit user-space why not
run a 64bit kernel anyway?
> Heck, use of ECC memory can slow down a system by as much as 1% AFAIK, and
> still, use of ECC is pretty much a given everywhere people really cares
> about stability (e.g. you cannot even buy servers from non-joke vendors
> without chipkill memory...)
I wasn't aware of a 1% slowdown, however I have observed that the vendors that
ship ECC systems tend to ship them some months after equivalent machines are
available in non-ECC versions. Being 3-6 months behind the cutting edge of
technology is effectively more than a 1% loss.
> It *is* quite measurable when it is ON and enforcing policy, but since we
Measurable being as much as 5% depending on what you do (usually significantly
less than 5%).
> > > It is not enabled by default. That is the other point: you get that
> > > selinux integration if you want or not.
>
> Yes, and exactly what is the problem with that?
>
> Have you *ever* looked at the ammount of libraries we link to in Debian?
> SE Linux libs are small compared to most of them, and *far* more useful.
Maybe the people who complain about SE Linux overhead would be better off
using Gentoo. With Gentoo you can turn off every option that you don't need.
This gets you the minimal installed size for everything and also means that
you can discover exciting new bugs that other people haven't discovered.
--
russell@coker.com.au
http://etbe.blogspot.com/ My Blog
http://www.coker.com.au/sponsorship.html Sponsoring Free Software development
Reply to: