24 ms·
> Also, if there is a defense against ROP and other exploits that makes it possible to do away with ASLR and ESP please let me know. Memory safety. Everything
by ctz 9y ago
> Also, if there is a defense against ROP and other exploits that makes it possible to do away with ASLR and ESP please let me know.
Memory safety.
Everything else (ASLR, DEP, CFI, heap hardening, etc.) is just fiddling around the edges -- it's not an engineering approach that produces reliable or safe software.
- mrich 9y agoAgreed; but until we get there, we must make sure the software we ship from existing codebases is as safe/unexploitable as possible.