Re: [9fans] pathetic

[dbailey27@ameritech.net]

> The attacker gets less
> control if he can't force-feed instructions, but he can still
> wreak havoc.

Not to mention the fact that we don't know how much a given
OS is going to implement the new paging semantics, if at all.

For all we know, Microsoft could use the media hype surrounding
this *miraculous* NE bit to fuel sales for their "professional" line
of server or business platforms. Use a cheaper Windows and you
might get hacked!

Obviously, we still haven't begin to poke at the semantics behind
heap pages being executable. You may overflow a buffer in a NE
page, but can you point to an executable heap page you've previously
written to? There are a million-and-one more scenarios here we've
all hashed over more than once.

This doesn't change a thing but an increase in AMD's stock value,
and Microsoft's later when they implement, then promote it. I've got
no problem with capitalism, but let's look at the facts. This only
alters an attacker's method. It doesn't even make them step in to
uncharted territory.

Don (north_)