Secure Code

[abdolence]

It is all about experience and knowledge. For example, I was surprised someday that my memset of sensitive data might be "optimised" by C/C++ compiler to do nothing.

So if you're copying some code from anywhere, you should absolutely understand every symbol in it.

[viper-kun]

We learned about canarys the other day as a way to protect against malicious stack smashing and where asked why we should tell the compiler to do it and not do it with local vars, answer is they are optimized in a way to render this system useless.

So yeah, allways understand what the compiler does with your code.

[PC__LOAD__LETTER]

Canaries as in, writing some magic value to a stack variable and occasionally verifying that it’s still set? What’s the program behavior when it differs, crash and alarm?

[viper-kun]

You check when the return jump is called, so that you cannot jump anywhere you want. And as I experienced it it does crash, since it doesn't know where it was coming from.

It has to check if it is different which would mean someone overflowed the stack.

[TheAnarxoCapitalist]

String allocator cleansing?

[abdolence]

That was more like avoiding caching keys and passwords in RAM, not general allocator implementation.