diff options
| author | Daniel Micay <danielmicay@gmail.com> | 2020-12-17 01:32:46 -0500 |
|---|---|---|
| committer | Daniel Micay <danielmicay@gmail.com> | 2020-12-17 01:32:46 -0500 |
| commit | c3f5f59c4545ac75eebac8a9d51719e0d12e17ce (patch) | |
| tree | a26839c2e3992e7d2b9c31683fbfeaf5f56ddc88 /static/features.html | |
| parent | d981e60c2f2122a69c824ce25eb3b5f39f81755c (diff) | |
move more content to the features page
Diffstat (limited to 'static/features.html')
| -rw-r--r-- | static/features.html | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/static/features.html b/static/features.html index e1a10453..780ff4b0 100644 --- a/static/features.html +++ b/static/features.html @@ -67,10 +67,18 @@ <li>Stronger app sandbox</li> <li>Hardened libc providing defenses against the most common classes of vulnerabilities (memory corruption)</li> - <li>Our own <a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">hardened malloc (memory allocator)</a> + <li>Our own <a href="https://github.com/GrapheneOS/hardened_malloc">hardened malloc (memory allocator)</a> leveraging modern hardware capabilities to provide substantial defenses against the most common classes of vulnerabilities (heap memory corruption) along with - reducing the lifetime of sensitive data in memory</li> + reducing the lifetime of sensitive data in memory. The hardened_malloc project is + portable to other Linux-based operating systems and is being adopted by other + security-focused operating systems like Whonix. The + <a href="https://github.com/GrapheneOS/hardened_malloc/blob/master/README.md">hardened_malloc + README</a> has extensive documentation on it. Our allocator also heavily influenced the + design of the <a href="https://www.openwall.com/lists/musl/2020/05/13/1">next-generation + musl malloc implementation</a> which offers substantially better security than musl's + previous malloc while still having minimal memory usage and code size.</li> + <li>Hardened compiler toolchain</li> <li>Hardened kernel</li> <li>Prevention of dynamic native code execution in-memory or via the filesystem for the base OS without going via the package manager, etc.</li> |
