Post #2991563
2026-03-03 20:01 UTC
@ljrk@todon.eu Yeah, stack overflows in particular feel to me like the programmer isn't really making a particular mistake that can be called a security bug, it just randomly happens in legitimate code... and the only thing that can reliably stop it is the compiler. So it kinda feels wrong to me to call it a hardening flag, it feels more like a... correctness flag?
Replies (2)
-
@ljrk@todon.eu 2026-03-03 21:10
@jann@infosec.exchange Very true^^ I guess the "hardening" name should nowadays be considered a historical artifact from the times where doing-weird-things-to-memory was sometimes a feature/optimization hack and thus intended, a flag that would stop this wouldn't enforce correctness but limit the programmer in their superhuman control over the machine :D
-
@jannic@hachyderm.io 2026-03-05 08:15
@jann@infosec.exchange @ljrk@todon.eu I wonder why it is still necessary to employ imperfect mechanisms like guard pages to avoid stack overflows. Shouldn't it be possible to have a stack pointer limit checked by hardware? Like https://interrupt.memfault.com/blog/using-psp-msp-limit-registers-for-stack-overflow on some ARM chips?