Heap Protection Mechanism

An anonymous reader writes "There's an article by Jason Miller on innovation in Unix that talks about OpenBSD's new heap protection mechanism as a major boon for security. Sounds like OpenBSD is going to be the first to support this new security method."

Comments

Re:Apologies to the Black-Eyed Peas

[mrtroy]

Immma get get get you drunk Get you love drunk off my heap Immma make make make you scream Make you scream make you scream! [...] My heap, my heap my heap, my heap My lovely lady lumps

For Real Security

[RAMMS EIN]

For real security, don't use C. I've advocated this many times before, and have recently written a new essay about how better programming languages can lead to better software. Although this essay isn't entirely focused on security, it does demonstrate that some of the most common security bugs simply cannot occur using, in this case, Common Lisp instead of C.

Re:new method?

[Taladar]

They created this user type so they have only themselves to blame.

This is why I couldn't use OpenBSD exclusively...

[ArbitraryConstant]

They're willing to break things in order to improve security. That's commendable, and I can't see myself using anything else for the firewall, but I simply cannot do without some software and some of it is binary-only. Does it break for me? I don't know, but from what Theo has said breakage isn't uncommon for large applications. I haven't checked because Java is poorly supported for unrelated reasons, and this rules out OpenBSD without me having to validate all my other software.

Also, the OpenBSD crowd is very quick to say that performance should be good enough for most purposes, but that's a copout. They have no idea what any particular person needs to do. The double-halt bug is a good example of how this is an issue. If they don't pay enough attention to performance to catch such a major issue quickly, they aren't going to be catching up to Linux or FreeBSD anytime soon.

Re:This is why I couldn't use OpenBSD exclusively.

[ArbitraryConstant]

"Just pointing out that unless a performance difference is glaring and sudden people tend not to mind or even notice. And I've seen crap Unix software and drivers too that users accepted as normal."

That depends on what you're doing. If it were an across-the-board 10% I probably wouldn't care, but it's not.

Linux 2.6 kernels are absoloutely outstanding at responsiveness, the only comparable experience I've had was with BeOS. It's pretty easy to tell whether or not (for example) your music skips under high load. Frankly, I've gotten used to being able to throw almost anything at my UP Linux machine without GUI or music being impacted perceptibly. Provided I'm not swapping, I haven't seen a slowdown under any load.

Nothing else out there at the moment seems to be able to do it. Windows can't do it, Mac can't do it, FreeBSD can't do it (even with ULE...), and OpenBSD certainly can't do it (my SSH sessions to my OpenBSD box get laggy when it's under high load).