←back to thread

Compiler Options Hardening Guide for C and C++

(best.openssf.org)
232 points pjmlp | 1 comments | 31 Mar 25 11:01 UTC | HN request time: 0.21s | source
Show context
derriz ◴[31 Mar 25 12:58 UTC] No.43534525[source]▶
Sane defaults should be table stakes for toolchains but C++ has "history".

All significant C++ code-bases and projects I've worked on have had 10s of lines (if not screens) of compiler and linker options - a maintenance nightmare particularly with stuff related to optimization. This stuff is so brittle, who knows when (with which release of the compiler or linker) a particular combination of optimization flags were actually beneficial? How do you regression test this stuff? So everyone is afraid to touch this stuff.

Other compiled languages have similar issues but none to the extent of C++ that I've experienced.

replies(4): >>43534781 #>>43535229 #>>43535747 #>>43543362 #
nly ◴[31 Mar 25 13:24 UTC] No.43534781[source]▶
I've rarely seen more than a handful of compiler options even on very large codebase

If anything there's tonnes people should be using more of.

The problem with all these hardening options though is they noticeably reduce performance

replies(1): >>43535548 #
1. grandempire ◴[31 Mar 25 14:35 UTC] No.43535548[source]▶
> The problem with all these hardening options though is they noticeably reduce performance

Yep. What I would really like is 2 lists, one for debug/checked mode and one for release.