LLVM Moves Forward With A Security Group For Dealing With Security-Related Issues

[phoronix]

Phoronix: LLVM Moves Forward With A Security Group For Dealing With Security-Related Issues

Given the increasing number of security issues requiring compiler-based security mitigations with the likes of the Intel LVI attack to Arm Straight Line Speculation just being the two latest examples, Apple's LLVM team has been spearheading a new security group for the upstream LLVM developer community to better manage security-related matters...

http://www.phoronix.com/scan.php?page=news_item&px=LLVM-Security-Group-2020

[Raka555]

They should add something like -M0 .. -M3 (or similar) like with the -O0 .. -O3
Then you can opt in or out the mitigations easily.
My fear is that they will add stuff which you can't switch off.

[kloczek]

As Linux still has no possibility to block "unknown" (unknown undestood as not well known or produced by trusted source) implementing such hacks is pointless.

[lowflyer]

I have the impression that we (the whole IT industry) are heading in the wrong direction. It should not become "normal practice" to fix flaws of the silicone by patches to the compilers. It seems to me that many hardware manufacturers have (speaking to you Intel and ARM!), in the blind race for speed, completely neglected every security consideration. The hardware is the place that has to change - not the compilers.

Another point: I'm still able to code in assembler and circumvent all that compiler stuff completely - I guess the bad guys are not that far behind me.

[cipri]

I have the impression that we (the whole IT industry) are heading in the wrong direction. It should not become "normal practice" to fix flaws of the silicone by patches to the compilers. It seems to me that many hardware manufacturers have (speaking to you Intel and ARM!), in the blind race for speed, completely neglected every security consideration. The hardware is the place that has to change - not the compilers.

Another point: I'm still able to code in assembler and circumvent all that compiler stuff completely - I guess the bad guys are not that far behind me.

on point!
working around bugs is not a long term solution. Even if this patches are helping partially to fix stuff in software, this will just take away pressure from the hardware manufacturer to not push for a fix (since this costs money). This is the reason why I am supporting risc-v , they are more engaged on doing things right.