Kernel Hardening - security-misc

[Patrick]

Kicksecure Network Configuration

It’s not fingerprinting that concerns me, but the security implications which are still valid for KS. Disabling MTU probing was necessary along with some other TCP options to mitigate the SACK vuln. You might say that it is fixed and water under the bridge, but the argument still stands that the less functionality turned on in the kernel the safer and really that’s the only thing we care about here as long as performance is usable and acceptable. If your system is prone to these TCP SACK PAN…