←back to thread

Compiler Options Hardening Guide for C and C++

(best.openssf.org)
232 points pjmlp | 2 comments | 31 Mar 25 11:01 UTC | HN request time: 0s | source
Show context
derriz ◴[31 Mar 25 12:58 UTC] No.43534525[source]▶
Sane defaults should be table stakes for toolchains but C++ has "history".

All significant C++ code-bases and projects I've worked on have had 10s of lines (if not screens) of compiler and linker options - a maintenance nightmare particularly with stuff related to optimization. This stuff is so brittle, who knows when (with which release of the compiler or linker) a particular combination of optimization flags were actually beneficial? How do you regression test this stuff? So everyone is afraid to touch this stuff.

Other compiled languages have similar issues but none to the extent of C++ that I've experienced.

replies(4): >>43534781 #>>43535229 #>>43535747 #>>43543362 #
duped ◴[31 Mar 25 14:05 UTC] No.43535229[source]▶
I mean if you emit compiler commands from any build system they're going to be completely illegible due to the number of -L,-l,-I,-i,-D flags which are mostly generated by things like pkg-config and your build configuration.

There's not many optimization flags that people get fine grained with, the exception being floating point because -ffast-math alone is extremely inadvisable

replies(2): >>43535861 #>>43547656 #
dapperdrake ◴[31 Mar 25 15:04 UTC] No.43535861[source]▶
-ffast-math and -Ofast are inadvisable on principle:

Tl;dr: python gevent messes up your x87 float registers (yes.)

https://moyix.blogspot.com/2022/09/someones-been-messing-wit...

replies(2): >>43535920 #>>43542503 #
1. bobmcnamara ◴[01 Apr 25 03:22 UTC] No.43542503[source]▶
"what kind of math does the compile usually do without this funsafemath flag? Sad dangerous math?"
replies(1): >>43543114 #
2. dapperdrake ◴[01 Apr 25 05:22 UTC] No.43543114[source]▶
There are things like floating point exceptions (IEEE 754) and subnormal numbers (close to zero, have less precision than the small approximation error "machine-epsilon"). The idea is to degrade gracefully. These additional features require additional transistors and processing which raises latency.

If you really know (and want to know) what you are doing, turning this stuff off may help. Some people even advocate brute-forcing all 2^32 single floats in your test cases, because it is kind if feasible to do so: https://news.ycombinator.com/item?id=34726919