Re: A way to prevent buffer overflow exploits?

Shriram Krishnamurthi <shriram@cs.rice.edu>
16 Aug 1998 22:43:46 -0400

          From comp.compilers
Related articles
[4 earlier articles]
Re: A way to prevent buffer overflow exploits? dlmoore@pgroup.com (David L Moore) (1998-08-02)
Re: A way to prevent buffer overflow exploits? pizka@informatik.tu-muenchen.de (1998-08-03)
Re: A way to prevent buffer overflow exploits? fjh@cs.mu.OZ.AU (1998-08-04)
Re: A way to prevent buffer overflow exploits? bear@sonic.net (Ray Dillinger) (1998-08-10)
Re: A way to prevent buffer overflow exploits? eodell@pobox.com (1998-08-13)
Re: A way to prevent buffer overflow exploits? khays@sequent.com (1998-08-16)
Re: A way to prevent buffer overflow exploits? shriram@cs.rice.edu (Shriram Krishnamurthi) (1998-08-16)
Re: A way to prevent buffer overflow exploits? conway@cs.mu.OZ.AU (1998-08-16)
Re: A way to prevent buffer overflow exploits? genew@vip.net (1998-08-17)
Re: A way to prevent buffer overflow exploits? conway@cs.mu.OZ.AU (1998-08-17)
Re: A way to prevent buffer overflow exploits? chase@world.std.com (David Chase) (1998-08-19)
Re: A way to prevent buffer overflow exploits? eodell@pobox.com (1998-08-19)
Re: A way to prevent buffer overflow exploits? richard@exaflop.org (Richard Matthias) (1998-08-19)
[1 later articles]
| List of all articles for this month |
From: Shriram Krishnamurthi <shriram@cs.rice.edu>
Newsgroups: comp.compilers
Date: 16 Aug 1998 22:43:46 -0400
Organization: Rice University, Houston, Texas
References: 98-07-242 98-07-246 98-08-014 98-08-029 98-08-081
Keywords: C, practice, comment

eodell@pobox.com (Eric O'Dell) writes:


> [Buffer overflows = programmer laziness, pure and simple.]


> IMHO, if this is a problem for your organization, it's a sign that
> your hiring practices, and not your programming tools, are at fault.


You should read the fuzz-testing papers that Barton Miller and
Co. from Wisconsin have published in CACM. I believe the original
came out in 1990, and a follow-up in about 1995. It appears that even
the mightiest of employers in this industry -- the ones supposedly
with the smart programmers -- have, ah, faulty hiring practices.


'shriram
[Were those the experiments that showed that nearly every program that
came with Unix crashed when fed random input? Pretty sad. -John]
--

Post a followup to this message

Return to the comp.compilers page.
Search the comp.compilers archives again.