[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <564B7B6C.7090503@gmail.com>
Date: Tue, 17 Nov 2015 14:09:32 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Fwd: x86 ROP mitigation
> Why not both?
>
> Security is about layers, this is a nice place for a new security layer.
It needs to provide something meaningful to be a layer. There is a
performance and complexity budget too. Landing a security feature should
involve explaining the threat model and the plan to fully address it. It
can be a very narrow threat model, sure. SSP is an example of a feature
with *very* narrow threat model and a very high performance cost for
what it actually accomplishes and yet it's still quite useful (but it
could be replaced with something much better).
It's not going to be increasing the cost of exploit development if it
only means a script ends up finding different gadgets instead. Maybe it
leads to better tooling being developed if it's far enough along, but
that's one person investing their time once, not every exploit taking
more resources to develop. If it's incomplete, how is it a layer?
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
