Replying to @gannimo
To be fair, it’s because you have a big part in writing history and you cut the single most important person out of it because evaluating their work was a little too hard for you (their paper wasn’t officially published and their work wasn’t packaged for immediate reproduction).
1
From afar, it just appears you should accept responsibility for your mistake and try to correct it, but you just keep doubling down and trying to blame the other person—because they made it easier for you to make a mistake.
1
Hu? We give credit in our papers for an idea to restrict control flow. After RAP was published we tried several times to evaluate it, likely for 20+ hours without success. The author is unwilling to help and keeps yelling at us, yet it is our mistake? Tell me where I'm wrong :)
1
Now, if you emailed him I’m perfectly willing to admit I’m wrong. But he seems to publicly offer help all the time and nobody EVER refutes his claims that he never got any emails asking for help. Is this any different?
what compatibility issues and why did you never report anything to me? FWIW, the public version works with linux fine, it's production quality.
1
You desperately need to answer this as well.
your google skills notwithstanding, how does this effort of yours mesh with nitter.vloup.ch/gannimo/status/1… where you said you had already tried (and failed, for unspecified reasons) to evaluate RAP?
2
You talk about how it was difficult to evaluate his work, but isn’t it your job to evaluate all the important, practical implementations available? How did you feel happy publishing an incomplete paper? Was it because LLVM was clearly better? How did you know?
2
Does LLVM even have any sort of efficient shadow stack mechanism for x86/x64? As far as I can remember it’s decently slow and not as secure as PaxTeam’s return address protections. Maybe PaxTeam’s implementation also suffers from mild speed issues in this area.
1
I’m aware of the documents. You didn’t answer my questions.
1
"but isn’t it your job to evaluate all the important, practical implementations available?" No. If we publish new work we compare against available implementations of the state of the art. RAP is neither the state of the art nor available.
3
Replying to @gannimo @MattDenton
so what you downloaded the other day wasn't RAP, i see. and how do you know it's not state of the art if you never evaluated it? but then last week you said that you had so maybe clear up that confusion first?

Dec 21, 2018 · 12:34 PM UTC

1
Replying to @paxteam @MattDenton
Instead of arguing, invest the time and provide a writeup/open implementation. I'll silence this thread now as were not making any progress