Re: [gentoo-dev] Stack smash protected daemons

[Stephen P. Becker]

>
> Ciaran,
>
>  Go back and reread your own posts you seem to be contradicting yourself.
>
>  If you have anything further constructive to add then lets hear it. Otherwise
> changing the default CFLAGS in make.conf is the sensible way forward. Please
> remember nobody is forcing you to stick to the default CFLAGS.
>
>  I'm bored with this argument.
>
>  Bart

Regardless of what you, I, or anybody else thinks about security, 
wouldn't you agree it is a bad thing to include default CFLAGS in 
make.conf that potentially a) break compilations, b) impact performance, 
and/or c) introduce bug reports to upstream maintainers about why their 
program isn't building or working right, or why it is slow?

I've spent time in #gentoo, and have seen how badly people break their 
CFLAGS.  There is no point in helping them break their CFLAGS.  Why not 
simply put a blurb about SSP in the install handbook detailing what 
those CFLAGS do, including the pros/cons.  Then, new users can choose 
whether they want them or not.  I think new users are far more likely to 
just add to the default CFLAGS instead of removing them.  If they have 
read the docs and weighed out the potential benefits or problems, I 
think this is a much better situation than just adding them because you 
think that security should be the priority of every install.

Steve


--
gentoo-dev@g.o mailing list