Re:Make Ubuntu packages 90% faster by rebuilding them
by ryao on Tuesday March 18, 2025 @10:06PM
(#43407610)
ASLR is technically a form of security by obscurity. The obscurity here being the memory layout. The reason nobody treated it that way was the high entropy that ASLR had on 64-bit, but the ASLR⊕Cache attack has undermined that significantly. You really do not want ASLR to be what determines whether an attacker takes control of your machine if you care about having a secure system.
[ Parent
| on HN ]
Re:Make Ubuntu packages 90% faster by rebuilding them
by pdpi on Tuesday March 18, 2025 @11:30PM
(#43408039)
The defining characteristic of security through obscurity is that the effectiveness of the security measure depends on the attacker not knowing about the measure at all. That description doesn’t apply to ASLR.
Re:Make Ubuntu packages 90% faster by rebuilding them
by ryao on Wednesday March 19, 2025 @01:46PM
(#43415140)
It produces a randomization either at compile time or run time, and the randomization is the security measure, which is obscured based on the idea that nobody can figure it out with ease. It is a poor security measure given the AnC attack that I mentioned. ASLR randomization is effectively this when such attacks are applicable:
https://web.archive.org/web/20240123122515if_/https://www.sy...
Re:Make Ubuntu packages 90% faster by rebuilding them
by graymatters on Wednesday March 19, 2025 @01:01AM
(#43408394)
You are confusing randomization, a legitimate security mechanism, with security by obscurity. ASLR is not security by obscurity.
Please spend the time on understanding the terminology rather than regurgitating buzz words.
Re:Make Ubuntu packages 90% faster by rebuilding them
by ryao on Wednesday March 19, 2025 @01:39PM
(#43415052)
I understand the terminology. I even took a graduate course on the subject. I stand by what I wrote. Better yet, this describes ASLR when the AnC attack applies:
https://web.archive.org/web/20240123122515if_/https://www.sy...