I want to evaluate whether it's worth it to add ASLR to a proprietary operating system. This OS runs multiple applications that don't trust each other and exchanges data over the network, so the threats that ASLR mitigates do apply. Given infinite resources, I would add ALSR.
But resources are finite. Maybe we'd get a stronger security by spending time on other pursuits such as more intensive testing, finer static analysis, general design improvements, etc.
We can look at our OS and evaluate the cost of ASLR (initial design, avoiding address leaks through e.g. timing, greater difficulty of debugging, …). How can we evaluate the benefits?
ASLR doesn't prevent vulnerabilities, it only makes exploits more difficult. I tend to think that the least exploitable vulnerability is the one that doesn't exist and attackers will always find a way, but this is just a feeling, I don't have data. Is it common for ASLR to make exploitation impossible? How can we quantify the benefits of ASLR?