User:Bluefoxicy
|
|
Hi.
Hobbies
I'm a computer security ameture. I use Linux, specifically Gentoo Linux, with a PaX enhanced kernel and Stack Smash Protected and Position Independent executable base.
I aspire to become a computer programmer fluent in the C, C++, and Objective-C programming languages. I am currently working on a development framework in Objective-C which will implement a proprietary API as well as the open standard OpenStep interface.
I am also working on a book, entitled Hard. This is a book on computer security, which will be published some time when Hell freezes over. It will contain general information about computer security, including physical security; security concepts that which will help to design and take advantage of a secure operating system; and programming techniques which will help to avoid bugs which create exploits in software.
I'm a PaX, Stack smash protection, and a Position independent executable base user, and believe that these are all appropriate and should be used as the basis for all desktop-aimed Linux distributions; enterprise servers must make a design decision as to whether or not to use these. The gains in security are suited for desktops, where your most pertainent threat is future MSBlast and Sasser type worms which attempt to get on the system without user intervention.
Ihe overhead, as I have unofficially benchmarked it, comes in at 0.7% for full PaX on x86 architectures. Overhead is effectively nil for amd64 and other architectures supporting an NX bit.
StackGuard has been measured as "negligible," or effectively 0; ProPolice is similar in implementation, so should measure the same.
I have measured[1] (http://d-sbd.alioth.debian.org/pax/pie.txt) the overhead of Position independent code on both x86 and amd64 with gcc compiler optimizations (-O3). The overhead is about 0.99% on x86, and effectively nil on amd64. With -fomit-frame-pointer, there is an approximately 5% performance gain on x86, which PIC cannot handle; thus, the hit becomes about 6%. On amd64, the hit measured between PIC and non-PIC is 0.02-0.03%.
The performance detriment is not noticable for desktops, and not significant when faced with the gains on either desktops or on servers where these technologies would be appropriate. It is my goal to get these and other transparent security systems which show no visible effects to the end user implemented into Debian and other Linux distributions.
Despite my personal views, you can clearly see that I keep PaX as NPOV as possible. :)
I'm published on LWN (http://lwn.net/Articles/106214/).
Awards
I've won some awards on Wikipedia :) I'll archive them here.
Barnstars
- For contributions done to PaX to help raise it to featured article status
- Awarded by →Raul654
- 06:37, Aug 11, 2004 (UTC)
Bye now :)
- redirect All your base are belong to us