Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <DA3D0190-CFCA-4184-9EC6-76E129EDCCE1@dwheeler.com>
Date: Wed, 15 Oct 2014 07:49:10 -0400
From: "David A. Wheeler" <dwheeler@...eeler.com>
To: oss-security@...ts.openwall.com,Florian Weimer <fweimer@...hat.com>
Subject: Re: Thoughts on Shellshock and beyond

> Buffer reuse is common in languages with memory safety (so that I/O 
throughput is not bounded by garbage collector throughput).  The impact 
is reduced (you only leak prior buffer contents, whatever that might be, 
not anything which happens to be in the vicinity on the heap).  But I 
don't think it's true that memory safety prevents such information leaks

Heartbleed definitely would have been countered by memory-safe languages.  NIST even demonstrated that address sanitizer countered it, which is direct experimental proof.  More info at http://www.dwheeler.com/essays/heartbleed.html



--- David A.Wheeler

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.