Hacker News Reader

Windows has DEP and ASLR. They are actually pretty much on par with each other from a TLA standpoint.

There are configuration issues that affect security that should be taken into account if you have high security needs. Its not a capabilities issue.

View on HN

Does Windows enforce ASLR on every process now? You only need one non-ASLR library to leverage with ROP. Though, you could say this falls under configuration (and I'm pretty sure the vsyscall table on x86_64 linux is still non-ASLR and that seems like a pretty trivial source of ROP gadgets), but I guess my point is its not as simple as supporting ASLR, not all implementations are created equal.

Not all implementations are created equal. I will cede that point.

And you're right, I would call that configuration.

Is there any equivalent of AppArmor on Windows? You can lock down the capabilities of an app pretty hardcore on Linux.

Sandboxie?

That's actually the new security model that Metro apps use. They are sandboxed by default with a declarative privileges model. I think its called AppContainer?

Here's a blog post: http://recxltd.blogspot.com/2012/03/windows-8-app-container-...

Reply on news.ycombinator.com