ASLR turns some unsuccessful buffer overflow attacks into system crashes. About all that can be said for address space randomization is that it's better than doing nothing. It has the useful feature that it makes it harder to reproduce buffer overflow bugs, which allows developers to avoid the work of finding and fixing them.
"We must do something. This is something. Therefore we must do this." - Yes, Minister
That's pretty much what were left with for unsafe code protection eh? And still stuff gets through... I'm wondering why we don't have runtime code rewriting, where the loader reorders code fragments, inserts unconditional jumps in places, etc. to make exploitation harder.
