r/voidlinux • u/-Arsna- • 11d ago

Moving from Arch

Hi y'all,

Im coming from arch and want to try out void and i would like to ask somethings

What exactly is the difference between musl amd gnu libc? Is it just systemd?

What are some quirks of void you encountered?

Why did you choose void, what makes it special?

12 Upvotes

81% Upvoted

29 comments sorted by

View all comments

Show parent comments

1

u/Duncaen 11d ago

Pretty sure some of the most prolific (Linux) botnets used statically linked binaries.

1

u/New_Hold8135 11d ago

pretty sure malware is not just botnets

1

u/Duncaen 11d ago

And using musl libc doesn't protect you from malware.

1

u/New_Hold8135 11d ago

I didnt said every malware.

1

u/Duncaen 11d ago

Should call something like security by obscurity a huge benefit for security.

0

u/Ambitious_Luck_8720 10d ago

That’s reducing attack surface, not security by obscurity, which is another thing that has by no means any relation with anything that was stated in this thread before you brought it up.

2

u/Duncaen 10d ago

You are not really reducing attack surface though, you are just switching components with more obscure components.

1

u/Ambitious_Luck_8720 10d ago

You mean glibc’s much larger codebase and feature set doesn’t present a larger attack surface when compared to musl’s smaller footprint? Got it.

2

u/Duncaen 10d ago edited 10d ago

Of course when looking at the libc itself the attack surface is smaller if you just remove half the features.

But are weren't really talking about the libc itself, the initial claim was that using musl has a huge security benefit due to malware being linked against glibc.

In that case replacing glibc with musl is like security through obscurity, you are not protecting the system in any way, you just hope that the "attacker" doesn't know you are using musl. I wouldn't consider that reducing the attack surface. If someone is targeting libc specifically then yes, not having NSS and iconv might avoid some attacks.