4 ms·
> But… till now they’ve hardly accomplished anything compared to what PaX/Grsecurity did, e.g. they ported some mitigations while introducing more (exploitable?
by lclarkmichalek 9y ago
> But… till now they’ve hardly accomplished anything compared to what PaX/Grsecurity did, e.g. they ported some mitigations while introducing more (exploitable?) bugs or incomplete implementations
That doesn't seem particularly charitable. Regardless of what you think of the Linux Foundation's marketing arm, the KSPP is not a bad thing. They seem to have a very different priority to PaX/Grsecurity, with an emphasis on things that have a clear technical/political/etc path to being enabled by default.
I really enjoyed this talk about KSPP's agenda: https://www.youtube.com/watch?v=aMkCKeZ8xZw https://www.youtube.com/watch?v=aMkCKeZ8xZw
- hardenedlinux 9y agoas citypw posted it on: https://lwn.net/Articles/703000/ https://lwn.net/Articles/703000/ We don't have such leap of faith in KSPP due to there are several exploitable bugs( CVE-2017-0358, CVE-2016-1583, CVE-2016-0728, CVE-2017-6074, CVE-2017-7184, etc), which can be turned to "massive" exploitations in past couple of months. And it's just the tip of the iceberg in past 16 years: https://lwn.net/Articles/721122/ https://lwn.net/Articles/721122/ There are tons of features from PaX/Grsecurity, e.g: PAGEEXEC/SEGEXEC/ASLR/KERNEXEC/UDEREF/MPROTECT/RAP/etc. None of them are created by KSPP even though some vendors integrated some of features( weakened usually) into hardware in recent years.
- dfc 9y agoI cant tell what you are responding to in the initial comment?
- cryptarch 9y agoIt seems to back up this quote: >> they ported some mitigations while introducing more (exploitable?) bugs or incomplete implementations I also disagree with GP that there isn't much of a point in using KSPP if it makes your system less secure and is not maintained diligently.