> splice() is the fastest and most efficient way to transfer data through pipes (on Linux), especially for large volumes. It bypasses memory allocations in userspace (as opposed to read(v)/write(v)), there is no extra buffer management logic, there is no memcpy() or iovec traversal.
Proper use of io_uring should finally have it beat or at least matched.
> are suppression files ever actually used due to an actual false positive,
There used to be one in LuaJIT because it had an optimized string comparison that compared outside of the allocation (which is allowed by the OS as long as you don't cross a page boundary, which LuaJIT's allocation algorithm made sure it never did)
The trouble is, as far as I know, that the ME cannot be deactivated. Even if you are a really sensitive network.
Your option is to find some of the few Intel chips without it, or find another chip vendor.
This often means you can't use common off the shelf systems, so now you can be a victim of a targetted supply chain attack.
