Unsecure optimization?

Posted Jan 24, 2016 2:01 UTC (Sun) by aggelos (subscriber, #41752)
In reply to: Unsecure optimization? by apoelstra
Parent article: OpenSSH and the dangers of unused code

Did I say otherwise anywhere? I didn't mean to. I was using a Box as a simple example of a non-Copy type.

Fair enough, though your example did have me wondering until I read the comments below.

I'd like to keep discussing the issues with tooling that might make zeroing of sensitive data unreliable, but at this point I can only marvel at how the discussion in the comments concerns itself with the (un)reliability of a mitigation for a very specific exploit of one, out of various different kinds of, memory safety vulnerabilities. To the point where one person assumed that the mention of rust had to do with /that/, instead of the bigger picture (happens to be your comment too but this is coincidental, especially given that your later responses in this subthread were in response to my direct question).

Seems disturbingly like a case of missing the (vast) forest of memory safety vulnerabilities for this particular tree (and then the next one, and the one after that :/), to my eyes at least.