Hi xor, do you have any specific cases you can discuss?
I suggest you sanitize the information before discussing it.
As far as I know, in the kernel config at:
http://tinycorelinux.net/16.x/x86/release/src/kernel/config-6.12.11-tinycoreThese security-related features are not enabled, which may cause security concerns:
CONFIG_STACKPROTECTOR
CONFIG_RANDOMIZE_BASE
CONFIG_FORTIFY_SOURCE
CONFIG_SECURITY
However, some features are disabled. I guess this might be a compromise made for extreme size reduction.
PS: TinyCore’s architecture — consisting of a base system, read-only TCZ extensions, a modular ‘build-block’ style, and running entirely in RAM — effectively avoids most persistent threats, file tampering, malware residue, and permanent compromise.
However, it cannot mitigate runtime memory exploits, kernel vulnerabilities, network service flaws, TCZ supply chain attacks, or configuration issues.
Because the system and data reside in RAM, a successful exploit can compromise the session immediately without needing persistence.
It provides strong resilience against long-term infection, but not absolute security.