News for hackers. Stuff that matters.

A comment on Make Ubuntu packages 90% faster by rebuilding them. Parent comment

Re:Make Ubuntu packages 90% faster by rebuilding them by fc417fc802 on Wednesday March 19, 2025 @01:09AM (#43408435)
I'm inclined to agree and would like to point out that if you take a hardline stance that any reliance on the attacker not knowing something makes it security by obscurity then things like keys become security by obscurity. That's obviously not a useful end result so that can't be the correct definition.

It's useful to ask what the point being conveyed by the phrase is. Typically (at least as I've encountered it) it's that you are relying on secrecy of your internal processes. The implication is usually that your processes are not actually secure - that as soon as an attacker learns how you do things the house of cards will immediately collapse.

[ Parent | on HN ]
Re:Make Ubuntu packages 90% faster by rebuilding them by ryao on Wednesday March 19, 2025 @02:53PM (#43415944)
What is missing from these two representations is the ability for something to become trivially bypassable once you know the trick to it. AnC is roughly that for ASLR.
[ Parent | on HN ]
Re:Make Ubuntu packages 90% faster by rebuilding them by fc417fc802 on Wednesday March 19, 2025 @07:32PM (#43418371)
I'd argue that AnC is a side channel attack. If I can obtain key material via a side channel that doesn't (at least in the general case) suddenly change the category of the corresponding algorithm.

Also IIUC to perform AnC you need to already have arbitrary code execution. That's a pretty big caveat for an attacker.

[ Parent | on HN ]
Re:Make Ubuntu packages 90% faster by rebuilding them by ryao on Thursday March 20, 2025 @05:01AM (#43421038)
You are not wrong, but how big of a caveat it is varies. On a client system, it is an incredibly low bar given client side scripting in web browsers (and end users’ tendency to execute random binaries they find on the internet). On a server system, it is incredibly unlikely.

I think the middle ground is to call the effectiveness of ASLR questionable. It is no longer the gold standard of mitigations that it was 10 years ago.

[ Parent | on HN ]