So why are we in this mess? Because there are still buffer overflows. Address space randomization is done because buffer overflows allow exploits. But rather than fixing the underlying problem, we now have complex schemes to spread programs over the entire 64 bit address space to make such exploits unreliable. Then, apparently Microsoft's Javascript JIT engine has enough problems with buffer overflows that each compi…
If the current approach from the C+Unix era to programming and OS is still in use, there are only three solutions available...
1. Fix-and-miss all the bugs, safe programming practice.
2. Isolation
3. Mitigation
Isolation is useful to limit the scope of a security breach but cannot stop attackers from exploiting the bugs. The only solution which is able to stop attackers from exploiting existing programs is mitigation - you don't fix and miss individual bugs, bugs are always there, what we need stop attackers from exploiting them. Some exploits are easy to stop, hence NX. Others can only be stopped in a probabilistic way, hence ASLR.