2021-05-10 - securely clearing memory

whenever you read secrets into the application memory, you should clear it from the memory. tricky part in managed languages (like C#/Java/Python), but straight forward in C/C++, right? right? no… it's not. obvious things like memset() can be optimized away ("as-if" rule -- "dead code" can be removed).

in order to the way to go is to use function that is guaranteed not to be optimized away – for example explicit_bzero() on Linux/FreeBSD. and we're good, right? right? no… not exactly… the next problem is that these secrets are typically used for something and encryption/hashing algorithms can leave their internal state in the memory, that can make it easier to extract certain pieces of information… and this problem does not have a reasonable solution to this point.

so for the time being – just explicit_bzero() secrets that you have.