[SC-L] BSIMM: Confessions of a Software SecurityAlchemist(informIT)

[Andy Steingruebl]

On Wed, Mar 25, 2009 at 10:18 AM, ljknews <ljknews at mac.com> wrote:

>
> Worry about enforcement by the hardware architecture after
> you have squeezed out all errors that can be addressed by
> software techniques.\


Larry,

Given the focus we've seen fro Microsoft and protecting developers from
mistakes through things like DEP, ASLR, SEH, etc. why do you think that
these can't be done in parallel?  I mean, we used to not have Virtual Memory
or real MMUs and the developer had to make sure they didn't step on other
people's pages.  Hardware support for protection on pages has helped with a
lot of things right?

I'm not saying I'm holding out hope for hardware to solve all our problems
(that would be silly) but I do think it can be fairly useful for some
classes of problems and a lot more scalable/repeatable.  Practical right
now, no.  But we're sort of in the realm of fantasy in this discussion
already if we think the general mass of people writing software are going to
switch languages because certain ones are more reliable....

- Andy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://krvw.com/pipermail/sc-l/attachments/20090325/dd8dcad1/attachment.html