ponymontana💜⚡ on Nostr: mmm this optimizations dont change too much and theres no freelunch in my opinion. ...

mmm this optimizations dont change too much and theres no freelunch in my opinion. The only way to really optimize the kernel and reduce attack surface is to build it specifically for your machine and with the competence to tune all the specific parameters for your configuration, but even this way the performance gain is in the order of the 1% and the security gained is not too much if isnt completed in the other layers of the stack.

All the meaningful security feature can be gained with an updated generic kernel by customizing the kernel parameters on bootloader level and in the sysctl level (modifing two files basically). Here's a guide, some parameters are a bit outdated but is still pretty good: https://madaidans-insecurities.github.io/guides/linux-hardening.html#kernel