Fedora 31 Plans To Use GCC Security Hardening Flags By Default

[brad0]

Yay, more performance losses!

So we should remove locks on everything, passwords and all that? Beyond stupid comment.

[brad0]

That's even worse. Enabling features by default so that you have to use -fno-stack-protector to generate sane code is disgusting.

Not having it enabled by default so it doesn't generate sane code is fucking retarded.

[Weasel]

Not having it enabled by default so it doesn't generate sane code is fucking retarded.

Having to use -fno to disable things that GCC devs did not enable by default is retarded.

And lol at "sane" code.

I'm guessing you're one of those people doubting your every move because that's "sane" right? Sane code doesn't question itself because it's written properly in the first place, stack protector would make ALL code question itself even if it's perfectly fine. If a person would do that and question his every move he'd be put in mental asylum, which quite literally is the opposite of "sane".

In what world is that sane. Oh right the world of security morons.

[Weasel]

but by your damaged brain every compiler optimization not on by default i gues is insanse code too - welcome in 2019 retard

Cool story broski, but stack protector is the complete opposite of optimization so yes it should be off by default. Just like how debug is off by default if you use -O2 and above.

Some optimizations aren't on because obviously they don't fit into -O2 or whatever your options are. You don't have to turn them off though.

[jacob]

except with Flatpaks.

Flatpaks work just fine in Ubuntu.

[Grogan]

Exactly nothing on this page pertains to performance or performance loss. A nice link!

Well, it does speak about "-fstack-protector-strong" only enabling sensible behaviour that protects against stack overflows, without adding canaries in conditions where they are not needed. This reduces the performance impact compared to, say, -fstack-protector-all

This is not to say there is zero performance impact in compiling everything with -fPIC where not needed and stack protectors etc. in the first place though.

[Farmer]

Well, it does speak about "-fstack-protector-strong" only enabling sensible behaviour that protects against stack overflows, without adding canaries in conditions where they are not needed. This reduces the performance impact compared to, say, -fstack-protector-all

This is not to say there is zero performance impact in compiling everything with -fPIC where not needed and stack protectors etc. in the first place though.

I think the point people are making is that it's already been on for previous releases and there is thus no performance loss as whatever loss this would make already was made.

Can't slow down that which was already slowed down.

If it was slowed down due to this at that point. Don't know either way. Don't remember any screaming about it and I noticed no difference.

[dungeon]

in 10 years you can whine when your Debian does exactly the same, work in progress: https://wiki.debian.org/Hardening

Well, Debian started hardenizing packages since 8 years ago, nowdays nearly everything is already hardened.

So, since nearly everything is already hardened in major distros, then it makes sense to make it default in GCC too, so that you don't need to put additional flags if you do stuff on your own

Of course since "Security is Not a Product, It’s a Process" i am not sure why you still talking about future here?

[Weasel]

no, hardening flags should not be off by default idiot, they have to be enabled for obvious reasons everybody but you and a handful of your friends understands otherwise you have vulnerabilities in random binaries for no *measureable* performance gain and when i have to decide between thoeretical faster and theoretical secure given that i have a brain i select the more secure option - most people which fire up GCC out there have no clue about security at all and hence it ndees secure defaults - you are an idiot in every single topic at phoronix

Dude just shut the fuck up you stupid trash this is about COMPILING packages aka for DEVELOPMENT.

And if you have vulnerabilities it means the code is trash and you are trash for writing it and you should feel like a total trash because instead of fixing it you decide to add checks everywhere even if the code isn't trash (but if it's yours that's doubtful).

Nobody gives a SINGLE FUCK about your piece of shit servers deployment here because this is about DEVELOPMENT and compilation not about installing a bunch of pre-built packages which a monkey like yourself does.

Vulnerabilities don't grow in trees. You write them. Retard.

If you fucking want to JUST COMPILE packages with your paranoia then use CFLAGS / CXXFLAGS moron. That's what you use for non-standard compiler options or "personalization".

Modifying the compiler to force your stupid piece of shit paranoia on the ENTIRE distro (since you compile with its compiler) is fucking disgusting.

[Weasel]

I think the point people are making is that it's already been on for previous releases and there is thus no performance loss as whatever loss this would make already was made.

Can't slow down that which was already slowed down.

If it was slowed down due to this at that point. Don't know either way. Don't remember any screaming about it and I noticed no difference.

You guys are missing the point just like hreindl. This isn't about your stupid distro packages it's about development and what you build.