Video: https://www.youtube.com/watch?v=F_Kza6fdkSU

PDF: https://grsecurity.net/10_years_of_linux_security.pdf

PPTX: https://grsecurity.net/10_years_of_linux_security.pptx

It's unlikely to be affected by spectre-like attack since Rocket chip based core doesn't have speculative exec.

https://riscv.org/2018/01/more-secure-world-risc-v-isa/ https://www.sifive.com/blog/2018/01/05/sifive-statement-on-m...

We've been using PaX/Grsecurity on Debian( as server) and Linux Mint( as Desktop) for a while. It's working perfect fine until now. You can also tweak the reproducible builds as well:

https://github.com/hardenedlinux/grsecurity-reproducible-bui...

As exmaple of Linux Mint: https://hardenedlinux.github.io/system-security/2016/01/10/h...

as citypw posted it on:

https://lwn.net/Articles/703000/

We don't have such leap of faith in KSPP due to there are several exploitable bugs( CVE-2017-0358, CVE-2016-1583, CVE-2016-0728, CVE-2017-6074, CVE-2017-7184, etc), which can be turned to "massive" exploitations in past couple of months. And it's just the tip of the iceberg in past 16 years:

https://lwn.net/Articles/721122/

There are tons of features from PaX/Grsecurity, e.g: PAGEEXEC/SEGEXEC/ASLR/KERNEXEC/UDEREF/MPROTECT/RAP/etc. None of them are created by KSPP even though some vendors integrated some of features( weakened usually) into hardware in recent years.

I cant tell what you are responding to in the initial comment?

It seems to back up this quote:

>> they ported some mitigations while introducing more (exploitable?) bugs or incomplete implementations

I also disagree with GP that there isn't much of a point in using KSPP if it makes your system less secure and is not maintained diligently.