4 ms·
You know OpenBSD has been built with stack protection since 2003? It was the first OS to integrate what was then the outside GCC patch ProPolice (it has since b
by brohee 12y ago
You know OpenBSD has been built with stack protection since 2003? It was the first OS to integrate what was then the outside GCC patch ProPolice (it has since been interated in mainline gcc and is the standard -fstack-protector).
Given that and the fact httpd is made by people which know and care about the issues you point, there is much street cred to be had exhibiting a buffer overflow on the stack of this program.
- jacquesm 12y agoAnd no software has ever been ported over to other operating systems or flavours of similar operating systems...
- theonemind 12y agoI don't think they aim for portability, and give valid reasons why they don't. For instance: http://www.openssh.com/?vm=r http://www.openssh.com/?vm=r """ OpenSSH is developed by two teams. One team does strictly OpenBSD-based development, aiming to produce code that is as clean, simple, and secure as possible. We believe that simplicity without the portability "goop" allows for better code quality control and easier review. The other team then takes the clean version and makes it portable (adding the "goop") to make it run on many operating systems -- the so-called -p releases, ie "OpenSSH 4.0p1". """ Obviously, I'm quoting from OpenSSH's page here, but I believe it's probably the same philosophy on why they're writing code that relies on the security properties of OpenBSD.
- agumonkey 12y agoIt's funny, sounds like a bad transplant.