A Skeleton Key of Unknown Strength (CVE-2015-7547)
Toward the end of the essay there&#x27;s an excellent and provocative summary of the way forward:<p><pre><code>  My concerns are not merely organizational.  I do think we   
  need to start investing significantly more in mitigation 
  technologies that operate before memory corruption has 
  occurred.  ASLR, NX, Control Flow Guard – all of these 
  technologies are greatly impressive, at showing us who
  our greatly impressive hackers are.  They’re not actually 
  stopping code execution from being possible.  They’re
  just not.

  Somewhere between base arithmetic and x86 is a sandbox 
  people can’t just walk in and out of.  To put it bluntly, 
  if this code had been written in JavaScript – yes, really – 
  it wouldn’t have been vulnerable.  Even if this network 
  exposed code remained in C, and was just compiled to 
  JavaScript via Emscripten, it still would not have been 
  vulnerable.  Efficiently microsandboxing individual 
  codepaths is a thing we should start exploring.  What can 
  we do to the software we deploy, at what cost, to actually 
  make exploitation of software flaws actually impossible, as 
  opposed to merely difficult?</code></pre>