3 ms·

It could be that it's easier to reverse (closed source) apps (with unreviewed code after each DevSecOps Pull Request with Changelog entry) with debugging symbol

It could be that it's easier to reverse (closed source) apps (with unreviewed code after each DevSecOps Pull Request with Changelog entry) with debugging symbols. gdb on Fedora auto-installs signed debuginfo packages with debug symbols; Fedora hosts a debuginfod server for their packages (which are built by Koji) and sets `DEBUGINFOD_URLS=https://debuginfod.fedoraproject.org/ https://debuginfod.fedoraproject.org/ ` : https://fedoraproject.org/wiki/Debuginfod https://fedoraproject.org/wiki/Debuginfod https://fedoraproject.org/wiki/Changes/DebuginfodByDefault#Security_FAQ https://fedoraproject.org/wiki/Changes/DebuginfodByDefault#S... Without debug symbols, a debugger has to read unlabeled ASM instructions (or VM opcodes (or an LL IR)). From "Show HN: Tetris, but the blocks are ARM instructions that execute in the browser" https://news.ycombinator.com/item?id=37086102 https://news.ycombinator.com/item?id=37086102 : > "Ask HN: How did you learn x86-64 assembly?" (2020) re: HLA, : https://news.ycombinator.com/item?id=23931373 https://news.ycombinator.com/item?id=23931373 re: the Diaphora bindiff tool and ghidra, which has GDB support now FWIU: https://news.ycombinator.com/item?id=36454485 https://news.ycombinator.com/item?id=36454485 "Show HN: Ghidra Plays Mario" the NES ROM. https://news.ycombinator.com/item?id=37475761 https://news.ycombinator.com/item?id=37475761

creatonez 3y ago
In the context of Linux distros like Fedora -- How does having separated debug symbols improve the security posture, though? Sure, it adds another step to exploitation, but not an insurmountable one. (It seems like that DebuginfodByDefault FAQ is discussing the security implications of the debugger's parsing of debug symbols itself, rather that of the security of shipping debug symbols in the first place)

creatonez 3y ago

In the context of Linux distros like Fedora -- How does having separated debug symbols improve the security posture, though? Sure, it adds another step to exploitation, but not an insurmountable one. (It seems like that DebuginfodByDefault FAQ is discussing the security implications of the debugger's parsing of debug symbols itself, rather that of the security of shipping debug symbols in the first place)