3 ms·

My initial interpretation, when I had heard about the EMET EOL, was that Microsoft was doing it as a way to spin removing dev effort from EMET into leveraging p

My initial interpretation, when I had heard about the EMET EOL, was that Microsoft was doing it as a way to spin removing dev effort from EMET into leveraging people onto Windows 10. Now I'm not sure - Windows 10 doesn't have the full featureset, and I don't _think_ Microsoft is likely to actually introduce the entire featureset into Windows 10 with much lead time before the EOL. If they do, though, it would certainly be a nice carrot AND stick to get people up to at least a certain update version for that functionality.

ryuuchin 10y ago
I think the featureset that Windows 10 provides is good enough as an alternative (see my top level comment[1]). EAF was never that useful because it uses debug registers and the ROP protections have been "replaced" by CFG (control flow guard). Everything else is provided by a vanilla Windows 10 install. The usefulness of the EMET protections were that they could be used without having to recompile an application where protections like CFG do require recompilation with the latest Visual Studio (and for you to Opt-In to CFG). [1] https://news.ycombinator.com/item?id=13011211 https://news.ycombinator.com/item?id=13011211
- rincebrain 10y ago
  Yeah, but as your comment says, for me, a lot of the value was in adding mitigations for applications that were not pre-compiled with said options. Yes, some of them can be manually twiddled without recompilation, but it's not nearly as convenient to manage or deploy (though one imagines a GPO template to do all of the heavy lifting that's doable via IFEO would be a feasible thing), and for anyone not using GPOs, then you're reimplementing a poor subset of the EMET GUI over the IFEO parameters.
  - ryuuchin 10y ago
    > poor subset of the EMET GUI over the IFEO parameters. Is it really though? I guess it depends how much value you place on the EAF and ROP protections. Personally I wouldn't place too much weight on them.

ryuuchin 10y ago

I think the featureset that Windows 10 provides is good enough as an alternative (see my top level comment[1]). EAF was never that useful because it uses debug registers and the ROP protections have been "replaced" by CFG (control flow guard). Everything else is provided by a vanilla Windows 10 install. The usefulness of the EMET protections were that they could be used without having to recompile an application where protections like CFG do require recompilation with the latest Visual Studio (and for you to Opt-In to CFG). [1] https://news.ycombinator.com/item?id=13011211 https://news.ycombinator.com/item?id=13011211

rincebrain 10y ago
Yeah, but as your comment says, for me, a lot of the value was in adding mitigations for applications that were not pre-compiled with said options. Yes, some of them can be manually twiddled without recompilation, but it's not nearly as convenient to manage or deploy (though one imagines a GPO template to do all of the heavy lifting that's doable via IFEO would be a feasible thing), and for anyone not using GPOs, then you're reimplementing a poor subset of the EMET GUI over the IFEO parameters.
- ryuuchin 10y ago
  > poor subset of the EMET GUI over the IFEO parameters. Is it really though? I guess it depends how much value you place on the EAF and ROP protections. Personally I wouldn't place too much weight on them.