Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 05 Dec 2014 21:45:22 -0500
From: Daniel Micay <>
Subject: Re: Offset2lib: bypassing full ASLR on 64bit Linux

On 05/12/14 07:55 PM, Pavel Labushev wrote:
> On Fri, 5 Dec 2014 14:15:03 -0800
> Reed Loden <> wrote:
>> For the record, Mozilla tried it several months ago and had to back it out.
>> "Nautilus (the file manager) can't open PIE executables, which makes
>> distributing PIE executable essentially impossible."
> Like it's essentially impossible to invoke the target ET_DYN binary via
> a shell script or an ET_EXEC executable wrapper.

Yup, it's a pretty lame excuse.

Firefox is only looking at using ASLR for the first time in 2014, and it
lost to supporting the workflow of opening Nautilus, navigating to some
directory and double-clicking the binary (could just be a wrapper...)
rather than using the .desktop file (or the CLI, or $LAUNCHER) or
shipping a script for this.

It's sad. Even if GNOME decides to add another hack to make this work,
it'll be 6 months to get it released and another 2-3 years before
Mozilla considers using it.

Meanwhile, plenty of other corporations (Valve, Google, [...]) are
shipping PIE binaries without trouble - their user-facing app launchers
even have icons, i18n and more in Nautilus, because they're not raw

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.