Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 24 May 2015 13:43:21 -0700
From:      "K. Macy" <kmacy@freebsd.org>
To:        Bryan Drewery <bdrewery@freebsd.org>
Cc:        freebsd-arch@freebsd.org, Oliver Pinter <oliver.pinter@hardenedbsd.org>,  Shawn Webb <shawn.webb@hardenedbsd.org>, Pedro Giffuni <pfg@freebsd.org>
Subject:   Re: ASLR work into -HEAD ?
Message-ID:  <CAHM0Q_O4bCTaVi5HvKohrcYE--Yw8Yoo-0wEp1ScnF=qLiiQiQ@mail.gmail.com>
In-Reply-To: <555FBE83.6080103@FreeBSD.org>
References:  <555CADB6.202@FreeBSD.org> <CAPQ4fftbUUSMHYXjOD-yO0ZzxdKwXzd5LA5AycrEyKMT3o63xw@mail.gmail.com> <555CC369.1030206@FreeBSD.org> <555FBE83.6080103@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On May 22, 2015 4:41 PM, "Bryan Drewery" <bdrewery@freebsd.org> wrote:
>
> On 5/20/2015 12:24 PM, Pedro Giffuni wrote:
> > My claim is that the majority of "professional" breachers and
> > governments already have ASLR workarounds pre-coded and ready
> > to launch. Finding an exploit is more difficult than beating
> > ASLR so they are not going to hint everyone that they have
> > an exploit until they can take all the linux/windows/MacOSX
> > at the same time.
> >
> > The cost for the NSA and/or anonymous to step on
> > ASLR is zero.
>

Correct. But who are we really protecting against? If it's the NSA only air
gap will really do.  In reality it's just a matter of making the cost of
circumventing protections exceed the value of the data or items being
protected. Locking one's doors and windows doesn't make one's house
impenetrable by any stretch, but it does deter opportunistic passerby.

Protecting against state overreach is a political matter and shouldn't
factor into whether to invest in deterring lesser malfeasors.

I'm sorry, but Bryan has it right. The political discussion is a side show.

-K

> This sort of argument easily turns into "why bother with security?".
> Please be careful with it. Every layer and mitigation helps. The real
> world is not just NSA or China. It's also full of script kiddies. Should
> we just stop using SSL because NSA might have cracked it? Should we just
> hand over root ssh keys to China because they probably have it all
> hacked anyway? Should we just give up since billions of dollars pour
> into security breaking research? Should I just post my CC here since
> it's surely leaked from the hundreds of places I use it at anyway? No.
>
> I've had very basic security checks, that could be easily circumvented,
> stop actual script kiddies before. Had they persisted longer I would
> have been in major trouble. If I explained what it is you would surely
> laugh it off and tell me to not bother. Well it worked. ASLR has its
> place too.
>
> --
> Regards,
> Bryan Drewery
>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAHM0Q_O4bCTaVi5HvKohrcYE--Yw8Yoo-0wEp1ScnF=qLiiQiQ>