EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 11·5 min read
Cleaning costs, or, examining the OpenBSD -fret-clean flag
TL;DR
OpenBSD's -fret-clean flag, introduced in version 7.6, enhances security by instructing the LLVM compiler to zero out specific memory locations. This targeted mitigation aims to improve system resilience against certain types of attacks.
✦ Why It Matters
Consider implementing the -fret-clean flag in your OpenBSD systems to enhance security against memory exposure.
Key Takeaways
- Assess the cost versus benefit of using -fret-clean in your codebase.
- Consider existing security measures before implementing new mitigations.
- Benchmark performance impacts of compiler flags on your specific architecture.
- Stay informed about empirical evaluations of security mitigations.
How It Works
-fret-clean modifies the LLVM compiler to insert a command that clears the return address on the stack after function calls, aiming to prevent ROP attacks.
⚠ The Catch
Despite its effectiveness in removing return addresses, the mitigation does not significantly hinder attackers, as many other pointers remain accessible.