One of the challenges with deploying ASLR for everything is that, at least on Windows, some DLLs (libraries) are not compiled in a way that's compatible with ASLR. (They're not compiled as position-independent code, and so the place where they are loaded in memory cannot be randomized.)
This is problematic, because if an application loads even just one non-randomized DLL, then it is effectively not randomized. To stop standard attacks (e.g., ROP attacks), all the code has to be randomized: even a single non-randomized DLL is enough of a foothold that ROP attacks can become possible. So, to a first-order approximation, ASLR is only useful in protecting a particular application if all of its DLLs are randomized. Applications often load many DLLs, and since all it takes is one non-randomized DLL, this makes it especially important to ensure that all DLLs are randomized.
Generally, the industry is moving towards increased use of randomization, but slowly: I guess it takes time to bring this to every DLL any program will ever use. For instance, it was recently revealed that the Dropbox DLL does not use randomization, so any program that uses the Dropbox DLL is not protected against ROP attacks (any program that uses the Dropbox DLL loses the benefit of ASLR).
My question: What are the typical reasons why some DLLs are not randomized? Is it typically some sort of technical barrier or technical issue that makes it difficult or impossible to compile the DLL as position-independent code? Is it lack of awareness/attention to security, on the part of the developers building the DLL? Is it legacy DLLs that are very old and haven't been recompiled to take advantage of randomization? Does Microsoft Visual C++ fail to do the right thing by default (does it fail to compile DLLs as position-independent code by default)? Is it something else entirely?
Are there any technical advances or tools that would help facilitate greater deployment of ASLR/randomization for DLLs that currently don't support randomization?
Related resources: SlopFinder is a tool to scan your system for DLLs that don't support ASLR.