Re: [gentoo-dev] Stack smash protected daemons

[Dave Monnier]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ciaran McCreesh wrote:

> Personally, I would be *very* wary about giving our x86 users a 5%
> performance hit just to enable a hack which might protect you if your
> app happens to be badly coded in a particular way... The option's there
> for anyone that wants it, but turning it on by default probably isn't
> wise...
>

5% ??

I have to ask what you're talking about.  Please read the IBM papers,
specifically,

http://www.research.ibm.com/trl/projects/security/ssp/node5.html#SECTION00051000000000000000

Please read the entire evaluation and not just the overhead on function
calls. That example is not based on real computing, the bottom example's
however, are.

SSP really is a good thing, and it really is nearly free.  In fact, due
to compiler requirements, the -O2 may actually yield faster code under
many situations.   This is a real world solution to a real world
problem.  The idea here is that we should be convincing people to
*adopt* these things, not move away from them based on false judgments.
 Even Microsoft has realized the value of guard injection.

Cheers,
- -Dave

- --
| Dave Monnier - dmonnier@××.edu - http://php.indiana.edu/~dmonnier/ |
|  Lead Security Engineer, Information Technology Security Office    |
|  Office of the VP for Information Technology, Indiana University   |
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBUitrBIf6jlONJjIRApo7AJ93fFfeRN18qHgcpdyKIuXuMD1t8wCgx2iG
tUjlZuWcOnL03ONa02XzJl0=
=KFzD
-----END PGP SIGNATURE-----

--
gentoo-dev@g.o mailing list