[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 16 Feb 2014 12:19:23 -0800
From: Nick Kralevich <nnk@...gle.com>
To: oss-security@...ts.openwall.com
Cc: "CERT(R) Coordination Center" <cert@...t.org>
Subject: Re: Vendor adoption of PIE INFO#934476 oss-security
On Sun, Feb 16, 2014 at 11:54 AM, Nick Kralevich <nnk@...gle.com> wrote:
> Statically linked executables with PIE are
> not supported today [4], although I'd love to see it in the future.
>
> [4] http://comments.gmane.org/gmane.comp.gnu.binutils/56324
Expanding on what I wrote earlier...
The Google security patch rewards program [5] rewards security
improvements in open source projects, such as GCC, llvm, and Android.
While I can't speak for the committee which approves these rewards,
I'd be happy to support and recommend rewards to any security
researcher who implements statically linked PIE support. In my mind,
there are three possible rewards here, one for GCC, llvm, and Android.
[5] https://www.google.com/about/appsecurity/patch-rewards/
--
Nick Kralevich | Android Security | nnk@...gle.com | 650.214.4037
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
