Contributed by grey on from the a little good news is better than no news at all dept.
"There's lots of open-source software out there that no one has analyzed and is no more secure than all the closed-source products that no one has analyzed. But then there are things like Linux, Apache or OpenBSD that get a lot of analysis. When open-source code is properly analyzed, there's nothing better. But just putting the code out in public is no guarantee."
Another brief mention comes in this week from Anandtech's A bit about the NX bit; Virus Protection Woes. Here is the relevant excerpt from the piece:
"In fact, NX/XD is a good first step to locking down the x86 architecture, as long as it's adopted correctly. OpenBSD and the Execshield projects have made the largest progress with implementing non-executable writable pages and other features, if only in software."
(Comments are closed)
By Anonymous Coward (213.118.91.118) on
That guy from PaX is going to be so pissed because his hobby horse isn't mentioned... offtopic I know - sue me.
Comments
By mirabile (213.196.242.88) on http://mirbsd.de/
Comments
By Anonymous Coward (211.30.147.144) on
Comments
By Anonymous Coward (211.30.147.144) on
By Anonymous Coward (194.72.54.134) on
By djm@ (203.217.30.86) on
By PaX Team (81.182.142.231) pageexec at freemail.hu on http://pax.grsecurity.net./
if still in doubt, just look at your own moderation points that you earned with your schadenfreude.
1. http://www.undeadly.org/cgiaction=article&sid=20020609090353&pid=131
Comments
By SH (82.182.103.172) on
Comments
By PaX Team (81.182.76.119) pageexec at freemail.hu on
By tedu (67.124.88.60) on
(that was joke.)
By Anonymous Coward (195.217.242.33) on
the article was about NX bits, i didn't realise PaX used NX bits
it obviously can't on platforms that don't support it
OpenBSD only provides W^X on platforms that support NX on a page level
hmmm.... well maybe not on some x86, as segment based NX is used
Comments
By PaX Team (81.182.76.119) pageexec at freemail.hu on
> it obviously can't on platforms that don't support it
assuming you mean amd64's NX, PaX (or rather, linux itself) has always used that on that platform, but only in 64 bit mode (as noone asked for supporting NX on a 32 bit kernel on it). lately linux itself has added support for NX on 32 bit kernels on amd64 (and future i386 capable of NX), so i'll support that in the next release (all 4 lines it takes, that is ;-).
on other (non amd64/i386) platforms PaX either uses the 'native' NX bit (alpha, ia-64, parisc, sparc, sparc64) or something equivalent (ppc, that's all ppc, not only 4xx).
> OpenBSD only provides W^X on platforms that support NX on a page level
> hmmm.... well maybe not on some x86, as segment based NX is used
indeed, on i386 OpenBSD uses segmentation and userland tweaks to achieve W^X, but it's not per page. PaX provides per page NX behaviour on i386 by either of two approaches, each with a different tradeoff (userland address space size vs. performance impact).
Comments
By Anonymous Coward (195.217.242.33) on
It looks like it can only be acheived at the segment level.
I seem to remember that it can only be acheived per-page on Book E - Enhanced PPC.