Sounding important (was re: sacrificing performance for confusion)

[Jon Mini]

Unfortunately, security is not an all-or-nothing proposition.
Vulnerability analysis does not yield a yes or no answer.  Instead,
it yields a probability which is generally represented in terms of
the cost it likely to take in order to compromise the system.
Witness cryptography and message hashes.  Making a system more
secure is not a non-sensical statement.  What you are arguing is
that because some exploits exist other than the class described
here, you should not rule out this class of exploits.  Frankly,
this is idiotic.  I imagine that OpenBSD doesn't like your ideas
either.

Please stop making broad sweeping statements about things you don't
understand.  Not only are you making yourself the fool, but you are
misleading other people who might be ignorant and are reading these
lists looking to learn.

Also, making semantic arguments with people here is adolescent.
Obviously, because you have earned a doctorate in some field, you
have experience sounding intelligent in front other people. We
have no wish to see that here.

Please understand that this is one of the most diverse forums of
discussion on the areas of computer science as it applies to operating
system development.  From that follows that many of the people who
post here are going to speak using different words than you are
used to simply because their background also includes slightly
different nomenclature.  Many of them will not be fluent english
speakers and will have a hard time understanding your text without
a dictionary.  Also, the technical language of the computer industry
is as much a slang as in the legal industry.  Furthermore, realise
that this is an industry, not an area of academic investigation,
and that we have real deliverable goals that must be met and deal
with a wide population of people who speak a less precise technical
language.  There are many thousands, if not hundreds of thousands,
of people on the various FreeBSD lists at any given point in time
who fall into this category, and many many more who find our postings
in the archives during research using a search engine.

Attempting to say that we are inexperienced or unknowledgeable
because we do not use the correct, large, specific words is completely
contrary to what this forum is all about.  Here, we try to speak
clearly and in the simplest language possible because many of the
people who read this forum are not as well-versed in these topics
as we are, and many of whom would like to learn more.

In short, we do not care how learned you sound.  We only care about
whether or not you are accurate, and you are not.  When you are
wrong, we will be very helpful in correcting you.  This is not an
attack, it is one of the strongest and most valueble parts of the
FreeBSD community.  It saddens me that you do not wish to participate.
While you are wrong on these issues, I am sure that you have a good
wealth of knowledge that you could contribute to our intellectual
pool.

I am sorry that your usage case is not of interest to the project.
There are many projects.  I do not know of one off the top of my
head that fits your needs, but there probably is one.  If not, you
are welcome to start your own.

I have spoken enough to you on this subject.  Good luck in your
endeavours.

D. J. Bernstein [djb at cr.yp.to] wrote :

> Chuck Swiger writes:
> > However, I will also acknowledge that it may be the case that it may be 
> > possible for code to work around a non-executable stack
> 
> In every case that I've investigated, not only is it definitely possible
> to seize control of the process with limited exec, it's actually fairly
> easy. Maybe there are counterexamples, but you obviously don't know any.
> (Note to certain people making fools of themselves: that's ``seize
> control,'' not ``kill.'')
> 
> If disabling x bits becomes popular, attackers will start working around
> it, and we'll be back to where we are today. We need to stop the buffer
> overflows (and other problems) from occurring in the first place.
> 
> Anyway, it seems unlikely that you believe that stack-x data-non-x makes
> life any more difficult for the attacker than stack-x data-x; and you
> obviously think that stack-non-x data-non-x would be the best situation.
> So why do you object to merging the stack and data segments?
> 
> ---D. J. Bernstein, Associate Professor, Department of Mathematics,
> Statistics, and Computer Science, University of Illinois at Chicago
> _______________________________________________
> freebsd-performance at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-performance
> To unsubscribe, send any mail to "freebsd-performance-unsubscribe at freebsd.org"

-- 
Jonathan Mini <mini at freebsd.org>
http://www.freebsd.org/