Yo Eric! On Wed, 2 Sep 2020 20:35:38 -0400 "Eric S. Raymond" <e...@thyrsus.com> wrote:
> Gary E. Miller via devel <devel@ntpsec.org>:
> > Buffer overruns are just one way a program might make unexpected
> > system calls. Even if you can guarantee that a Go program could
> > never be maliciously corrupted externally, you can never guarantee
> > that the Go program can not be trojaned.
>
> Everything is cost gradients.
>
> Yes, a Go program could be Trojaned, but (a) that is far less likely
> than a buffer overrun is in C, and (b) there are reasonably efficient
> auditing methods to detect Trojanning, good enough that even static
> analyzers lilke Coverity and LGTM can usually catch them by looking
> for shellouts. Syscall blocking is not really the best-fit tool for
> defense against this kind of attack.
No one said the love of seccomp made any sense. But you don't take a
security blanket away from an infant.
RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
g...@rellim.com Tel:+1 541 382 8588
Veritas liberabit vos. -- Quid est veritas?
"If you can't measure it, you can't improve it." - Lord Kelvin
pgpXG7jmcAtXQ.pgp
Description: OpenPGP digital signature
_______________________________________________ devel mailing list devel@ntpsec.org http://lists.ntpsec.org/mailman/listinfo/devel
