Live data from Hacker News

Compiler Options Hardening Guide for C and C++

best.openssf.org

71–72 of 72 posts

Re: Compiler Options Hardening Guide for C and C++

#71
post #43

Earlier quoted context omitted.

Turning on -Werror means that once the warnings are eliminated, they stay eliminated, and a developer who adds code that produces a warning has their checkin rejected. If it isn't used the number of warnings will just grow and grow. You're right, updated compilers that have more warnings are an issue, and that's why the document recommends that -Werror be used during development but not in the shipped code (for open…

> If it isn't used the number of warnings will just grow and grow. Only in shitty teams without discipline and only if warnings are not tracked in some other way.

Most companies have such teams, fortunate of those that never experienced such employers.

Re: Compiler Options Hardening Guide for C and C++

#72
What about "-fno-delete-null-pointer-checks" (https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#ind...)?

I've never understood why you would want to delete null pointer checks. The redhat blog also mentions this: https://www.redhat.com/en/blog/security-flaws-caused-compile...

Post reply on HN