3 ms·

All Turing complete inputs can be attacked by sending an non-terminating program. You could limit the amount of time an input is allowed to run, but then it's n

by ared38 11y ago

All Turing complete inputs can be attacked by sending an non-terminating program. You could limit the amount of time an input is allowed to run, but then it's no longer Turing complete.

munin 11y ago
it turns out that every system we've ever devised has had a limit on the amount of time the input is allowed to run, so this really seems more like a matter of degrees. this is also only an "attack" if the availability of the system is an invariant that is relevant from a security perspective. usually, we care much more about confidentiality and integrity and absent termination sensitive noninterference (which is a different problem that langsec wholly ignores and has nothing to do with the complexity of the input), i'm not sure how the termination of a program will have any impact on its confidentiality or integrity...
- ared38 11y ago
  DoS isn't an attack? I agree it's less severe than leaking credit card numbers, but availability is a big deal in many applications.
  - munin 11y ago
    if DoS was the only problem we had to worry about, we would have won.