| ▲ | Retr0id 2 days ago | |||||||||||||||||||||||||||||||
I suppose it'd be easy enough to re-seed RNGs, but re-relocating ASLR sounds like a pain. (Although I suppose for Python that doesn't matter) | ||||||||||||||||||||||||||||||||
| ▲ | hinkley 2 days ago | parent | next [-] | |||||||||||||||||||||||||||||||
Off the cuff, the first step to ASLR is don’t publish your images and to rotate your snapshots regularly. The old fastCGI trick is to buffer the forking by idling a half a dozen or ten copies of the process and initialize new instances in the background while the existing pool is servicing new requests. By my count we are reinventing fastCGI for at least the fourth time. Long running tasks are less sensitive to the startup delays because we care a lot about a 4 second task taking an extra five seconds and we care much less about a 1 minute task taking 1:05. It amortizes out even in Little’s Law. | ||||||||||||||||||||||||||||||||
| ▲ | cperciva 2 days ago | parent | prev [-] | |||||||||||||||||||||||||||||||
Re-seeding is easy. The hard parts are (a) finding everything which needs to be reseeded -- not just explicit RNGs but also things like keys used to pick outgoing port numbers in a pseudorandom order -- and (b) making sure that all the relevant code becomes aware that it was just forked -- not necessarily trivial given that there's no standard "you just got restarted from a snapshot" signal in UNIX. | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||