summaryrefslogtreecommitdiff
path: root/static/features.html
diff options
context:
space:
mode:
authorDaniel Micay <danielmicay@gmail.com>2020-12-17 01:32:46 -0500
committerDaniel Micay <danielmicay@gmail.com>2020-12-17 01:32:46 -0500
commitc3f5f59c4545ac75eebac8a9d51719e0d12e17ce (patch)
treea26839c2e3992e7d2b9c31683fbfeaf5f56ddc88 /static/features.html
parentd981e60c2f2122a69c824ce25eb3b5f39f81755c (diff)
move more content to the features page
Diffstat (limited to 'static/features.html')
-rw-r--r--static/features.html12
1 files changed, 10 insertions, 2 deletions
diff --git a/static/features.html b/static/features.html
index e1a10453..780ff4b0 100644
--- a/static/features.html
+++ b/static/features.html
@@ -67,10 +67,18 @@
<li>Stronger app sandbox</li>
<li>Hardened libc providing defenses against the most common classes of vulnerabilities (memory
corruption)</li>
- <li>Our own <a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">hardened malloc (memory allocator)</a>
+ <li>Our own <a href="https://github.com/GrapheneOS/hardened_malloc">hardened malloc (memory allocator)</a>
leveraging modern hardware capabilities to provide substantial defenses against
the most common classes of vulnerabilities (heap memory corruption) along with
- reducing the lifetime of sensitive data in memory</li>
+ reducing the lifetime of sensitive data in memory. The hardened_malloc project is
+ portable to other Linux-based operating systems and is being adopted by other
+ security-focused operating systems like Whonix. The
+ <a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">hardened_malloc
+ README</a> has extensive documentation on it. Our allocator also heavily influenced the
+ design of the <a href="https://www.openwall.com/lists/musl/2020/05/13/1">next-generation
+ musl malloc implementation</a> which offers substantially better security than musl's
+ previous malloc while still having minimal memory usage and code size.</li>
+ <li>Hardened compiler toolchain</li>
<li>Hardened kernel</li>
<li>Prevention of dynamic native code execution in-memory or via the filesystem
for the base OS without going via the package manager, etc.</li>