Comments (5)
david-a-wheeler
commented on August 16, 2024
1
I recommend that we identify for each option flag the list of distros that use it, as that can help people gain confidence that it's okay or necessary to use/test with that option.
from wg-best-practices-os-developers.
ran-dall
commented on August 16, 2024
@david-a-wheeler So far, I've added Debian and Ubuntu. I plan on adding Red Hat and Gentoo next (sometimes before our next meeting, hopefully, if possible).
from wg-best-practices-os-developers.
david-a-wheeler
commented on August 16, 2024
Below are clarifications about what's happening on the compiler options draft work.
Hopefully that clarifies some things (and if I got something wrong, please let me know).
…--- David A. Wheeler
=======
The current draft of the "Compiler Options Hardening Guide for C and C++" is here:
https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler_Hardening_Guides/Compiler-Options-Hardening-Guide-for-C-and-C%2B%2B.md
This is work originally developed & donated by Ericsson - thank you!
The plan is for the community to build on it to have the "best available information".
@ran-dall is working to identify the default compiler options used by each independent Linux distro, with the goal of then comparing them. Indeed, *I* recommend that we identify for each option flag the list of distros that use it, as that can help people gain confidence that it's okay or necessary to use/test with that option. Issue:
#119
Identified list:
https://docs.google.com/document/d/1QGyDVgu0bGdKkdSIIJMHW35R044vGLa6-9tVs86A4_8/edit?usp=sharing
We had started work on an earlier draft. The plan now is to take the more-complete contributed work, and merge in the information from our earlier work. This is tracked in this issue:
#97
The earlier work is here:
https://docs.google.com/document/d/1SslnJuqbFUyTFnhzkhC_Q3PPGZ1zrG89COrS6LV6pz4/edit#
On Mar 1, 2023, at 2:57 PM, Randall ***@***.***> wrote:
@david-a-wheeler So far, I've added Debian and Ubuntu. I plan on adding Red Hat and Gentoo next (sometimes before our next meeting, hopefully, if possible).
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you were mentioned.
from wg-best-practices-os-developers.
ran-dall
commented on August 16, 2024
I recommend that we identify for each option flag the list of distros that use it, as that can help people gain confidence that it's okay or necessary to use/test with that option.
@david-a-wheeler That's a good idea. I'll move things around.
from wg-best-practices-os-developers.
ran-dall
commented on August 16, 2024
@david-a-wheeler Also, FWIW, I've noticed that most distros will default GCC for all other binaries (i.e., not compiled by the Distro's Build process) to the GCC Built-In Specification by default. Perhaps identifying what that default is would be useful.
from wg-best-practices-os-developers.
Related Issues (20)
- Compiler Options: GCC 13.1 analyzer options HOT 6
- Compiler Hardening Guide: `-Wl,-z,noexecheap` command-line option HOT 3
- Compiler Options Hardening Guide for C and C++, -D_LIBCPP_ASSERT HOT 9
- Microsoft C/C++ compiler and linker options are not covered by the hardening guide HOT 2
- generic language vs contextual guidance HOT 2
- Add Azure DevOps to SCM Best Practices HOT 4
- Revamp publishing of guides such as concise guides & scm guide HOT 6
- Modify CSS of generated pages HOT 18
- Modify pages to use the best.openssf.org site, if we decide to switch to it HOT 6
- alternatives to `bp.openssf.org` HOT 12
- Rename Compiler_Hardening_Guides to Compiler-Hardening-Guides
- Compiler Hardening Guide: Missing Binutils version for `-rpath` and `--enable-new-dtags` HOT 1
- Parameter validation checks HOT 6
- Add link from openssf.org to developers landing page
- Compiler attributes for improved security HOT 5
- Suggestions on Concise Guide for Evaluating Open Source Software HOT 5
- Scorecard roadmap review HOT 3
- [VOTE] APAC/Pacific TZ version of the BEST Working Group HOT 4
- [VOTE] - Adoption of Sterling Toolchain/Security Toolbelt SIG within the BEST WG HOT 13
- Formatting errors in Compiler Options Hardening Guide for C and C++ HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wg-best-practices-os-developers.