3 ms·

Yes, you can verify that it doesn't work by looking at godbolt. Here's a very simple example. https://godbolt.org/z/sqW8xcGEc https://godbolt.org/z/sqW8xcGEc .

by maldev 4y ago

Yes, you can verify that it doesn't work by looking at godbolt. Here's a very simple example. https://godbolt.org/z/sqW8xcGEc https://godbolt.org/z/sqW8xcGEc . For some reason everyone seems to suggest that when it's a currently open (For the last 5 years) issue on their github of it not working. Using a third party tool and binary patching is not an appropriate measure of securing a binary in the case of the linux strip util.

estebank 4y ago
The default hasn't been changed yet (and if you look at the tickets there's ongoing conversation), but you can use `--remap-path-prefix` today if you need it. https://godbolt.org/z/zTh36c6Pz https://godbolt.org/z/zTh36c6Pz
- maldev 4y ago
  That's good for the path. But there's still concern with the filenames being there, along with being mapped to specific functions. Filenames can be relatively unique and makes signature matching extremely easy. So it can still cause issues to people who have to worry about authoritarian regimes, as it's not out of the realm of this being enough evidence to arrest someone for having all the filenames. It also affects obfuscation and licensing in commercial products. As you can map most functions to a file based off of this handling and find code to target. It's even worse, as if you were to strip the string and replace them all with giberish, it's still possible to map each file by xref's and find related functions. With how signature are in RE tools, you can automatically detect crypto functions and then map that every other function in the file, finding licensing checks easily. The compiler should really respect privacy, and while the ticket is ongoing, it's been ongoing for 6 years and they just made it a bug last year, with no progress. This is a huge blocker for businesses or privacy related domains which instantly makes the language a no-touch.

by maldev 4y ago

estebank 4y ago

The default hasn't been changed yet (and if you look at the tickets there's ongoing conversation), but you can use `--remap-path-prefix` today if you need it. https://godbolt.org/z/zTh36c6Pz https://godbolt.org/z/zTh36c6Pz

maldev 4y ago
That's good for the path. But there's still concern with the filenames being there, along with being mapped to specific functions. Filenames can be relatively unique and makes signature matching extremely easy. So it can still cause issues to people who have to worry about authoritarian regimes, as it's not out of the realm of this being enough evidence to arrest someone for having all the filenames. It also affects obfuscation and licensing in commercial products. As you can map most functions to a file based off of this handling and find code to target. It's even worse, as if you were to strip the string and replace them all with giberish, it's still possible to map each file by xref's and find related functions. With how signature are in RE tools, you can automatically detect crypto functions and then map that every other function in the file, finding licensing checks easily. The compiler should really respect privacy, and while the ticket is ongoing, it's been ongoing for 6 years and they just made it a bug last year, with no progress. This is a huge blocker for businesses or privacy related domains which instantly makes the language a no-touch.