No, most of today’s attackers are not competent or well-funded, but you don’t hear about them because they’re not news. ASLR changes the game in that instead o

No, most of today’s attackers are not competent or well-funded, but you don’t hear about them because they’re not news. ASLR changes the game in that instead of a control flow vulnerability needing to be found, you also need an info leak and the ability to put that into the exploit. That’s a nontrivial improvement.