memory safety

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

Interviewers listen for precision: an overflow is an out-of-bounds write, an over-read is a different bug, and a use-after-free is about lifetime, not bounds. Getting the taxonomy right is most of the easy question.

Once data could not run as code, attackers stopped bringing code. The interview checks that you understand code reuse as an idea, and what forward-edge and backward-edge protections each enforce.

'It's just a crash' and 'mitigations are on' are the two answers that get candidates marked down. The scored answer separates the primitive, the reachability and the privilege, and treats a read bug as half of an exploit.

'Rewrite it in Rust' is a slogan, not a plan. The staff answer ranks components by exposure, stops new bugs at the boundary first, and keeps the old code contained while the language mix shifts.

Random input finds shallow bugs. Coverage feedback, sanitizers and a harness that reaches the parser are what make fuzzing find the deep ones. The interview checks all three, plus what happens after the crash.

A crash is not an exploit. Turning one into the other takes several steps, and every modern mitigation is designed to break one of them.

Exploit chains used by mercenary spyware depend on memory corruption. Tagging every allocation and checking the tag on every access attacks that dependency directly. The answer is how it works and where it stops.

Python sits on top of a lot of C and C++. The scored answer explains the bug class, what the mitigations do and do not stop, and where ML stacks are exposed.