Writing Exploit-Resistant Code with OpenBSD
The mitigations probably do increase exploit difficulty. I still think most of the security is much like we saw with Mac&#x27;s years ago: virtually nobody targets them. The mitigations in CompSci, such as CFI, often get broken when another team spends some time on them. Those talented folks probably only attack a tiny sample of designs, though. Much like black hats who go wherever the users, data, and money are. The more return for attack, the more they focus on that platform. That&#x27;s mostly Windows, Linux, iOS, and Android.<p>Right now, I assume any &quot;success&quot; of OpenBSD&#x27;s mitigations are a mix of (small one) actual increases in difficulty and (big one) benefit of being obscure system best breakers aren&#x27;t interested in. Long as they&#x27;re uninterested, it should stay safe from most attackers regardless of which mitigations they use. Much like Mac was with hardly any security.<p>We won&#x27;t know if the mitigations actually work until the kind of people who break mitigations, white or black hat, start focusing hard on beating them one by one or bypassing them all together (eg hardware exploits). Any talk of how strong they are is just speculation. The proof, if it turns up, would be prolonged attempts by highly-talented people to break them with consistent failure and&#x2F;or less access&#x2F;damage resulting.