[ Thanks to Jane Walker for this link.
]
“In a previous tip about securing Linux applications with
compiler extensions, we described a defense-in-depth layered
methodology (‘defense in depth’) to proactively mitigate the
potential for risk or damage arising from fatally-flawed
programming constructs.“In this article, a second layer is introduced to add
much-needed boundaries to checking to compiled C binaries, so as to
produce robust, reliable applications capable of withstanding
punishment from would-be attackers who try to break them…”