Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Could you be a bit more specific? As can be seen from the article, this is one part of a series describing several best practices you should follow when shipping binaries. This one article does not claim to cover everything. Also check part 1 and the upcoming ones.

Also, if there is a defense against ROP and other exploits that makes it possible to do away with ASLR and ESP please let me know.



> Also, if there is a defense against ROP and other exploits that makes it possible to do away with ASLR and ESP please let me know.

Memory safety.

Everything else (ASLR, DEP, CFI, heap hardening, etc.) is just fiddling around the edges -- it's not an engineering approach that produces reliable or safe software.


Agreed; but until we get there, we must make sure the software we ship from existing codebases is as safe/unexploitable as possible.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: