Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 09 Oct 2014 20:10:19 -0400
From: Chet Ramey <chet.ramey@...e.edu>
To: mancha <mancha1@...o.com>, oss-security@...ts.openwall.com
CC: chet.ramey@...e.edu
Subject: Re: Aftershock

On 10/8/14, 2:37 PM, mancha wrote:

> Maybe LoC is a poor metric but I don't want that to obscure the real
> message: the process's high dynamism post-disclosure. As you correctly
> point out, many recent parser flaws don't rise to the level of security
> concerns primarily because of the prefix/suffix barrier.
> 
> However, it's important to point out that critical piece of hardening
> was a post-disclosure innovation and, more importantly, was triggered by
> post-disclosure findings and interaction.

I absolutely agree, and think it's equally important to point out that
Florian came up with it, not me.  There were other suggestions, some maybe
better, but that was the one we coalesced around.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
		 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@...e.edu    http://cnswww.cns.cwru.edu/~chet/

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ