On Sat, Apr 19, 2014 at 14:26:59 +0300, Riku Voipio wrote: [...] > Riding the Heartbleed publicity wave seems unwise, unless you can > propose a hardening flag that would have protected users from > Heartbleed. Else, Heartbleed merely serves on a example > how wallpapering problems over with "hardened" binaries often > doesn't help you at all.. >
+100 on this one. Hardening may be nice, but wouldn't have helped at all w.r.t. Heartbleed (or any of the other recent SSL/TLS issues). > Considering that most issues protected by compiler hardening are > also detectable by static/dynamic code analysis, a more effective security > measure would be to spend time with clang static analyzer, valgrind, trinity > and other tools... or actualy reviewing patches that security critical > projects recieve. > Or maybe even just enable -Wall when compiling and take compiler warnings seriously (plus explicitly silence the ones you are entirely sure they are spurious). I wish people did that, it would so much help even starting static analysis efforts as it helps rule out all the code that static analysis cannot formally reason about due to its inconsistencies in typing. See [1] for some of those - if only I had more time, I'd be reporting lots more that are still on my stack for review. And I haven't even started reporting missing include files (and thus missing declarations). I will propose an MBF for that as soon as time permits. Best, Michael [1] https://bugs.debian.org/cgi-bin/pkgreport.cgi?users=m...@debian.org&tag=goto-cc
pgpfve1WAfSgn.pgp
Description: PGP signature
