Show HN: Stensal SDK: Retrofitting C/C++ code with quasi-memory-safety

Re:Show HN: Stensal SDK: Retrofitting C/C++ code with quasi-... by the_why_of_y on Sunday January 13, 2019 @07:38AM (#18896439)

I think (1) is the wrong question to ask, because none of these tools are suitable for usage in a production deployment, so you will only find those bugs with them that can be triggered with your test suite, which is necessarily incomplete.

A better question is, is this new tool intended to be used in production deployments, and what, if any, new attack surface does it introduce?

[ Parent | on HN ]

Re:Show HN: Stensal SDK: Retrofitting C/C++ code with quasi-... by stensal on Sunday January 13, 2019 @09:49AM (#18896853)

As you have rightly pointed out the intended use case. I want to add more constraints to it. It's intended to be used in production deployments that are security critical, constant applying security patches is not an optimal solution, and slowdown is bearable.

It will introduce denial of service attack. QMS executables can operate in two modes: warning mode and crash mode. Both will reduce the level of service, but neither will allow memory accession violations to happen.

Edit: added more constraints to the suitable production deployments.

[ Parent | on HN ]