5 ms·
I agree that in case of buggy code stack allocated buffers are much easier to exploit, but in my post I assumed that the code is secure, i.e. the developer does
by conductor 12y ago
I agree that in case of buggy code stack allocated buffers are much easier to exploit, but in my post I assumed that the code is secure, i.e. the developer doesn't allow buffer overflows.
- jacquesm 12y agoYes, everybody always assumes that the code is secure. That's the root cause of the problem.
- Dewie 12y agoTo assume that the people behind OpenBSD put protections against that into their C programs is one of the less wild assumptions to entertain.
- jacquesm 12y agoOn the contrary, without reviewing the code you call that is the worst possible assumption you could entertain. But hey, why bother reviewing the code you call, the docs say that it is secure and that makes it so, right?
- Dewie 12y agoCalm down Jack. I wrote that it's one of the less wild assumptions: not that it's a reasonable assumption. To trust the OpenBSD's code with regards to security is more of a safe bet than trusting a lot of other organization's code. But of course, that's a relative statement: maybe it's still a horrible assumption.
- jacquesm 12y agoI'm pretty calm, it's just that I think that a reputation based approach to security is a bad one, especially because it creates a blind spot.