Re: _FORTIFY_SOURCE by default?

On Sun, 2012-09-16 at 00:41 -0400, Tom Lane wrote:
> Peter Eisentraut <peter_e(at)gmx(dot)net> writes:
> > _FORTIFY_SOURCE=2 appears to be the default for package building on many
> > Linux distributions now, as part of harding or security options. But we
> > often hear about problems related to this only when we hand the source
> > over to the packagers. So I think we might as well add this to our
> > standard compilation options, for example in src/include/port/linux.h.
> > What do you think?
>
> Doesn't seem like a good idea to me to add platform-specific options
> with unspecified effects to platform-independent upstream sources.

It's effectively a warning option, and we end up fixing all the warnings
anyway, so I don't see the point of deferring that effort. We could
rephrase this request as, how about adding this new warning option, it's
occasionally useful -- which we frequently do.

We add platform-specific warning and optimization options in many
places, and I don't think this is much different.