One of the problems with Linux is that it is so scalable. Limits that wouldn't sweat a 3Gz P4 with 4GB of ram would reduce my 200Mz P2 with 128MB of ram to a quivering pile of silicon, but I can install onto both from the same CD.

Similarly, limits that seemed reasonable on my P2 might have people complainig about arbitrary limits on the P4. Although it's a bit of a no-win situation for a distribution maker, I still agree that they have to come up with SOME sort of limit -- but that also requires clearly documenting how to change those limits when the prove to be unreasonably low (or high).

Something else that I'd point out is that preventing a local DOS is a lot harder than preventing a remote DOS -- especially if you want to avoid arbitrary limits on legitimate work. If we block forkbombing today, I'm sure we're going to see somebody 5 years down the road screaming about 'only' being allowed 2000 processes on the default build.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/308/31052#31052