GCC Initialization File?

[Jeffrey Walton]

On Tue, Dec 21, 2010 at 10:07 AM, Tony Wetmore
<tony.wetmore@solipsys.com> wrote:
> On 12/20/2010 10:00 PM, Jeffrey Walton wrote:
>>
>> The idea is that all programmers must use the defines. We can place
>> the defines in USER_CFLAGS on all machines. It then becomes a question
>> of how to retain the flags.
>
> Ah, that's different.  I thought your desire for those warning flags was a
> personal preference, not a project requirement.
>
> If everyone is supposed to use the same warnings, but some developers keep
> turning those off, your project/team has a management problem.
>
> I don't think GCC can help much with rogue developers.
It can be a tricky problem. Its a tough battle when folks like Linus
Torvalds or Ulrich Drepper make asinine statements [1, 2]. Many
programmers do not know any better and blindly follow their style and
advice in an attempt to be a l33t K&R coder.

I personally wish people would read Wheeler, Howard, LeBlanc, Viega
(or many others), and stop writing useless 1970's era code. Getting
pwn'd is not a badge of honor - it indicates a failure in your craft.
The environment is now toxic and hostile, and there is no place for
that style of code.

I spend about 1/4 to 1/3 of my week correcting [insecure] code written
in that style in preparation for future audits. Its too bad that the
folks who write it don't have to sit through a three day audit by a US
federal agency; or spend weeks correcting the code because security
related advice and requirements were not followed.

Jeff

[1] Linus Torvalds, "PATCH: Don't compare unsigned variable for <0 in
sys_prctl()". http://linux.derkeiler.com/Mailing-Lists/Kernel/2006-11/msg08325.html

[2] Ulrich Drepper, "PATCH: safe string copy and concetation".
http://sources.redhat.com/ml/libc-alpha/2000-08/msg00052.html

[3] David Wheeler, "Secure Programming for Linux and Unix HOWTO".
http://metalab.unc.edu/pub/Linux/docs/HOWTO/other-formats/ps/Secure-Programs-HOWTO.ps.gz