Re: [go-nuts] Re: Secure Go binaries

2016-12-22 Thread Ian Lance Taylor
On Thu, Dec 22, 2016 at 2:39 PM, Aaron Wood wrote: > > There must be other rare, obscure ways to exploit > overflows in code generated from Go, no? I sure hope not. If there are any, they are bugs that should be fixed. Ian -- You received this message because you are subscribed to the Google

Re: [go-nuts] Re: Secure Go binaries

2016-12-22 Thread Aaron Wood
Interesting, thanks for the info Ian. Other than the OS and distro requirements, is there any real benefit from generating PIE binaries with Go? There must be some vector that it protects again, even though most things are already bounds-checked. The only situation I can think of is if you're c

Re: [go-nuts] Re: Secure Go binaries

2016-12-22 Thread Ian Lance Taylor
On Thu, Dec 22, 2016 at 2:09 PM, Aaron Wood wrote: > > This is a rather old comment of yours but I was curious about a few things > you said. I agree that Go does take care of a lot of these problems (and > most other high-level languages try to too) so I'm curious as to why Go has > exposed a bui

Re: [go-nuts] Re: Secure Go binaries

2016-12-22 Thread Aaron Wood
Hi Russ, This is a rather old comment of yours but I was curious about a few things you said. I agree that Go does take care of a lot of these problems (and most other high-level languages try to too) so I'm curious as to why Go has exposed a build option for generating position independent exe