Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.forth > #56343
| From | anton@mips.complang.tuwien.ac.at (Anton Ertl) |
|---|---|
| Newsgroups | comp.lang.forth |
| Subject | Re: can forth outdo java? for web and everything? |
| Date | 2017-03-26 15:24 +0000 |
| Organization | Institut fuer Computersprachen, Technische Universitaet Wien |
| Message-ID | <2017Mar26.172449@mips.complang.tuwien.ac.at> (permalink) |
| References | (1 earlier) <ob67gp$qjp$1@dont-email.me> <ob67om$skf$1@dont-email.me> <xbKdnUlTL7JifkvFnZ2dnUU7-KmdnZ2d@supernews.com> <ob7dqe$50k$1@dont-email.me> <54ydnXB9t9ed3UrFnZ2dnUU7-SPNnZ2d@supernews.com> |
"Elizabeth D. Rather" <erather@forth.com> writes:
> How would a buffer overflow lead
>to a hack in Forth, particularly in a system with segregated code and
>data spaces?
See the slide titled "Separate return stack: does it protect?" in
http://www.complang.tuwien.ac.at/anton/euroforth/ef16/papers/ertl-secure.pdf
If you need the accompanying explanations, watch
https://wiki.forth-ev.de/lib/exe/fetch.php/events:security.mp4
Makes me wonder how you determine the security of your applications.
If it's just a checklist consisting of "Is it written in C?" and "Is
code and data space segregated?", that's far from sufficient.
>Most FORTH, Inc. applications nowadays are cross-compiled and running in
>microcontrollers, where we have segregated code and data space, and code
>space is usually in flash or rom for systems in the field. And, of
>course, comments and visible names are normally not available in
>cross-compiled apps.
None of that is a protection against attacks.
- anton
--
M. Anton Ertl http://www.complang.tuwien.ac.at/anton/home.html
comp.lang.forth FAQs: http://www.complang.tuwien.ac.at/forth/faq/toc.html
New standard: http://www.forth200x.org/forth200x.html
EuroForth 2016: http://www.euroforth.org/ef16/
Back to comp.lang.forth | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
can forth outdo java? for web and everything? gavino himself <jackvanc3@gmail.com> - 2017-03-24 21:22 -0700
Re: can forth outdo java? for web and everything? Helmar Wodtke <helmwo@gmail.com> - 2017-03-25 08:12 -0700
Re: can forth outdo java? for web and everything? Ron Aaron <rambamist@gmail.com> - 2017-03-25 20:00 +0300
Re: can forth outdo java? for web and everything? Cecil Bayona <cbayona@cbayona.com> - 2017-03-25 12:04 -0500
Re: can forth outdo java? for web and everything? Ron Aaron <rambamist@gmail.com> - 2017-03-25 21:08 +0300
Re: can forth outdo java? for web and everything? "Elizabeth D. Rather" <erather@forth.com> - 2017-03-25 11:41 -1000
Re: can forth outdo java? for web and everything? Ron Aaron <rambamist@gmail.com> - 2017-03-26 06:53 +0300
Re: can forth outdo java? for web and everything? "Elizabeth D. Rather" <erather@forth.com> - 2017-03-25 18:13 -1000
Security (was Re: can forth outdo java? for web and everything?) Ron Aaron <rambamist@gmail.com> - 2017-03-26 07:47 +0300
Re: can forth outdo java? for web and everything? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-26 15:24 +0000
Re: can forth outdo java? for web and everything? hughaguilar96@gmail.com - 2017-03-25 12:53 -0700
Re: can forth outdo java? for web and everything? jean-pierre@buechi-schmitt.ch - 2017-03-26 02:01 -0700
Re: can forth outdo java? for web and everything? gavino himself <jackvanc3@gmail.com> - 2017-03-29 21:43 -0700
csiph-web