Google Wants LLVM To Mainline x32 ABI Support

[JS987]

This slides says 2m11s is needed on 64-bit

Function get_random_int is different in latest kernels. Slides claim that it worked only for local attacker.

[LightBit]

It is maybe also possible to detect it on 32-bit, but on 64-bit attack would last much longer, which means much higher probability of detection.

This slides says 2m11s is needed on 64-bit

[JS987]

Why it can't be detected on 32-bit?

It is maybe also possible to detect it on 32-bit, but on 64-bit attack would last much longer, which means much higher probability of detection.

[LightBit]

Brute force attack isn't always possible and can be detected.

Why it can't be detected on 32-bit?

[JS987]

Shall we use 128-bit pointers just to prevent brute force attack?
40-bit (64-bit) can be brute forced quite fast.

Brute force attack isn't always possible and can be detected.

[LightBit]

I have 2^45 virtual memory according to /proc/meminfo

If I understand correctly x32 is more for low memory devices.

According to http://www.stanford.edu/~blp/papers/asrandom.pdf 64-bit is more secure because of more bits of randomization.

Shall we use 128-bit pointers just to prevent brute force attack?
40-bit (64-bit) can be brute forced quite fast.

[JS987]

1. ASLR is just makes attacks harder.
2. Attacker can reduce searching to virtual memory size. (so ASLR is more efficient with 64-bit pointers, only if you have more than 2^32 virtual memory)

I have 2^45 virtual memory according to /proc/meminfo
According to http://www.stanford.edu/~blp/papers/asrandom.pdf 64-bit is more secure because of more bits of randomization.

[LightBit]

32-bit pointers are insecure because of inefficient Address space layout randomization (ASLR).

1. ASLR is just makes attacks harder.
2. Attacker can reduce searching to virtual memory size. (so ASLR is more efficient with 64-bit pointers, only if you have more than 2^32 virtual memory)

[JS987]

32-bit pointers are insecure because of inefficient Address space layout randomization (ASLR).

[smitty3268]

Ok, you are right.
Let's take advantage of the latest and greatest closed source features from Adobe's Flash Player which was always great and had the best support for every operating system (outstanding stability on Linux) and with the best 3D API's to make the best games the Web has ever seen.

I'd probably just use Steam instead.