ASLR is controversial. Some see it as "security by obscurity;" others see it as extremely useful and effective. Yes, I would like it as a kernel build option, so that I can choose to optimize for raw speed (e.g. on a server which is hardened in other ways) or for the extra warm fuzzies that ASLR provides. --Brett Glass At 07:05 AM 3/9/2016, Piotr Kubaj wrote:>-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA256 > >Shawn Webb has recently announced that ASLR is complete on HardenedBSD. >There are patches ready for FreeBSD to use and it's ready to be shipped >in FreeBSD. However, for some reason FreeBSD developers do not want to >ship ASLR in FreeBSD. Why can't it be included at least as non-default >src.conf option and marked as experimental? > >FreeBSD is the only OS that matters that doesn't have ASLR.
On Wed, Mar 09, 2016 at 10:21:42AM -0700, Brett Glass wrote:> ASLR is controversial. Some see it as "security by obscurity;" others see > it as extremely useful and effective. > > Yes, I would like it as a kernel build option, so that I can choose to > optimize for raw speed (e.g. on a server which is hardened in other ways) > or for the extra warm fuzzies that ASLR provides.The great thing is that our implementation comes as a kernel build option, just like you want. Our implementation also works on a per-jail basis. Thanks, -- Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: not available URL: <http://lists.freebsd.org/pipermail/freebsd-security/attachments/20160309/fee095fb/attachment.sig>
> ASLR is controversial. Some see it as "security by obscurity;" others see > it as extremely useful and effective.In which way ASLR has something to do with security by obscurity? Imho this is a standard security feature of a modern OS. Regards, Sergej -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: OpenPGP digital signature URL: <http://lists.freebsd.org/pipermail/freebsd-security/attachments/20160310/1473270e/attachment.sig>