On: Hardening C/C++ Programs – Executable-Space Protection and ASLR

[ctz]

> Also, if there is a defense against ROP and other exploits that makes it possible to do away with ASLR and ESP please let me know.

Memory safety.

Everything else (ASLR, DEP, CFI, heap hardening, etc.) is just fiddling around the edges -- it's not an engineering approach that produces reliable or safe software.

[mrich → ctz]

Agreed; but until we get there, we must make sure the software we ship from existing codebases is as safe/unexploitable as possible.