1

I'm trying to understand why stack canaries are not enabled by default. It makes sense to me that they should be, given the interest in security? https://stackoverflow.com/questions/49693870/stack-canaries-can-be-disabled-by-compiler/49694377#49694377 implies that the overhead is not significant.

1
  • My guess is that it breaks required functionality otherwise. I cannot elaborate though, I would need to research more deeper. Commented Oct 12, 2022 at 12:46

1 Answer 1

4

It's hard to speak for the maintainers of GCC as I couldn't find a direct quote but let me give two reasons it may not be on by default:

  • Stack canaries have been shown to be less than foolproof. This of course is better than nothing but the options are not stack canaries or nothing. There are shadow stacks, StackGhost, ProPolice, languages which include bounds checking which eventually pass through a C compiler, etc.
  • The performance impact isn't awful on average but can be pretty rough, see the following diagram from the paper "The Performance Cost of Shadow Stacks and Stack Canaries" by researchers from Google and UC Berkley.

I can certainly see the logic as a project maintainer to avoid making something default that isn't considered done. When there is constant research into how to make it faster and better, it can be very easy to never call it done. And I can only imagine the bemoaning of all the "perfect" programmers out there if they had to constantly switch off this "unnecessary" feature.

enter image description here

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .