3 ms·

So let's get rid of the NX bit, aslr, heck why even run web processes with minimum privileges as you suggest? Just write exploit free software and launch them a

• imtringued 8y ago
  The problem with this "mitigation" is that it doesn't solve the problem and it takes away resources and attention from the proper solution. Checking a code signature on file load is a proven mitigation for preventing the execution of untrusted code.
  • joshuamorton 8y ago
    This doesn't help if the code you're executing changes after execution starts, or if it is dynamically generated (a sql query).
• klodolph 8y ago
  To clarify, my comment was suggesting that defense in depth is the correct way to do things (because exploit-free software is too hard to write, as you say). NX bit is a part of that, but polyscripting is stupid and should be thrown away. The problem with polyscripting is that it doesn’t provide any extra benefits that code signing doesn’t give you. In fact, it provides less security, more drawbacks, and has a greater implementation complexity (= attack surface) than code signing. With code signing you can be confident that someone with access to signed code can’t sign their own code, but with polyscripting as presented in the article, there does not appear to be any such assurance. Polyscripting reminds me of all the hackneyed copy-protection or anti-reverse-engineering techniques we saw back in the 90s.