Re: Stack Smash Protection disabled (was HEADS-UP: Stack Smash Protection enabled by default for amd64 and i386)

[Eric Haszlakiewicz <erh%nimenees.com@localhost>]

On Fri, Nov 13, 2009 at 12:57:53AM -0500, Elad Efrat wrote:
> I am not assuming the risk is infinite. I have pointed out that the
> impact of a stack overrun is the same in 1988 and in 2009, yet the
> speed of hardware on which software runs changed dramatically. This is
> a very important point. Next year we'll have faster computers that
> might drastically change the 5% figure; they will not change what
> happens if a stack overrun is exploited.

I hope this isn't being too nit-picky here, but faster hardware isn't going
to make one bit of difference in the 5% figure.  5% slower is still 5%
slower, regardless of what your starting point is.  Faster hardware will
just change the real time magnitude of the difference, shifting it towards
the point where people are more likely to find the performance acceptable
even with a 5% slowdown.

IMO, a 5% slowdown for a single feature seems a bit high, especially so if
it sets a precedent for other changes.  A handful of 5% slowdowns can
quickly add up to slow-as-molasses.  That said, I'd be ok with my machines
running a bit slower if it meant a significant improvement in security.

eric