On Thu, 01 Jan 2015 10:04:26 -0700 Theo de Raadt <dera...@cvs.openbsd.org> wrote:
> Ah, another arrogance -- you came here to advertise. Nope, if you read my first mail again, you'd see that I did not mention our project once and only presented it to challenge your assumption that I'm just some warrior presenting crude ideas. > You will gain little security or safety by rewriting everything for a > small and obscure userbase, without attacking the hard problems of > coding and enabling all possible mitigations. These words are very true. Even with arc4random() and given how long it has been around (and given how _obvious_ its benefits are), people still use PRNG's attempting to generate truly random data. > Static binaries are not a valid mitigation. > It sounds like you have no real word experience, because your userbase is > nonexistant. Maybe you are right. I must confess that I am an optimist and idealist when it comes to software development and looking at most software, mostly what I've seen in the last few years, you can't learn enough that there are many ugly spots in this area. You don't need a large userbase to see the issues even with a long-term switch to static binaries (so I definitely know what you're talking about) and that it is not a trivial thing. However, as a long-term perspective, one might hope that software development will actually take hardware-advancements in regard not by crufting software with more complexity, but by actually optimizing the foundation. You don't need to rewrite a lot to achieve that, same as you didn't have to rewrite a lot to make srand() truly random in builds that were non-deterministic. But I see that this discussion is getting nowhere for good reasons on both sides. So let's get back to coding. Happy hacking! Cheers FRIGN -- FRIGN <d...@frign.de>
