[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Switch on compiler hardening defaults

Kees Cook <kees@debian.org> writes:

> I would like to propose enabling[1] the GCC hardening patches that Ubuntu
> uses[2].  Ubuntu has used it successfully for 1.5 years now (3 releases),
> and many of the issues have already been fixed in packages that needed
> adjustment[3].  After all this time, use of the hardening-wrapper[4]
> package is still very low, so I think the right thing to do is to just fix
> this in the compiler and everyone wins.  I'm not suggesting that there
> won't be added work to fix problems, but I believe that for Debian the
> benefits now out-weigh the risks.

Agreed. The freeze is months away, there's plenty of time to deal
with the potential fallout of enabling this, so let's just do it.

Romain Francoise <rfrancoise@debian.org>

Reply to: