News for hackers. Stuff that matters.

A comment on What's Coming in Go 1.15. Parent comment

Re:What's Coming in Go 1.15 by mappu on Wednesday May 13, 2020 @01:21AM (#23163717)
It is commonly enabled for C++ compilers, but ASLR defends against attacks that Go code is not generally vulnerable to.
[ Parent | on HN ]
Re:What's Coming in Go 1.15 by zaarn on Wednesday May 13, 2020 @03:09AM (#23164287)
I'm not sure if that is accurate, ASLR defends against quite a range of attacks that are the result of code execution, which AFAIK can still occur in Go, Rowhammer comes to mind here as a universal crack against languages.

There is no downside to activating ASLR either, so I'm not sure why it isn't.

[ Parent | on HN ]
Re:What's Coming in Go 1.15 by swiley on Wednesday May 13, 2020 @08:47AM (#23166322)
Does addr2line still work with ASLR? Because that could be a reason not to.
[ Parent | on HN ]
Re:What's Coming in Go 1.15 by zaarn on Wednesday May 13, 2020 @09:03AM (#23166466)
addr2line works depending on the code and compiler/libc. Your libunwind may be able to output relativ code addresses, in which case addr2line will work if you use the stacktrace. GDB should handle this as well. If your c compiler doesn't support it you can just disable compiling PIEs which automatically disables ASLR but that should be reserved for debug builds.
[ Parent | on HN ]