Specific Examples (malloc) Started with junk-filling for free() then added in-kernel mmap() randomization then < page size randomization then cached-object randomization then multiple free detection then unique write-protected malloc(0) do { theo or miod suggests an idea otto makes more changes tedu suggests a speedup otto speeds it up } while (!bored(otto)); Some parts optional, some parts mandatory. Many developers run with the optional parts enabled.