| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20030815094118.GD19569@trusteddebian.org> Date: Fri, 15 Aug 2003 11:41:18 +0200 From: Peter Busser <peter@...steddebian.org> To: bugtraq@...urityfocus.com Subject: Re: Buffer overflow prevention Hi! > So the best protection is probably Propolice + non exec stack + write xor > executable pages. Oh, surprise, this is just how OpenBSD works. PaX is more strict in its W^R enforcement than OpenBSD. > This is still not a magical protection against everything. A vulnerable > application can still behave abnormally after an overflow. But this couple > makes injection + execution of arbitrary code way more tricky. Right there is no silver bullet. The only thing you can hope for is to raise the bar high enough that noone can jump over it. > The only way to sleep quietly is still to audit the code at the first place. The only way to sleep quietly in fact is to feed your computer to a shredder. Auditing code alone will not provide much security. In fact, it will lead to a false sense of security. The problem is that a modern UNIX system is that it contains millions of lines of code. Auditing this amount of code is simply impossible. Furthermore, auditors are humans. Humans make mistakes, not only when they are programmers, but also when they are auditors. So audited code will still contain security bugs. In fact, the amount of security in OpenBSD is only slightly less horrible than that of most *NIX operating systems (which includes Adamantix for that matter). Groetjes, Peter Busser -- The Adamantix Project Taking trustworthy software out of the labs, and into the real world http://www.adamantix.org/
Powered by blists - more mailing lists