[boost] Enabling spectre mitigation in boost libraries

Subject: [boost] Enabling spectre mitigation in boost libraries
From: Riff J (r12f.code_at_[hidden])
Date: 2019-04-04 23:52:32

Hi everyone,

I am a developer from Microsoft and currently using boost in our project.
We recently get noticed by our security team, that the boost library we
use, are not compiled with spectre mitigation (/Qspectre) enabled. Since
boost is super powerful, it might not be a good idea to write our own or
maintain our own version, so we are reaching out for help. Could anyone
please help see if we could enable /Qspectre option in the official build
of boost?

And here is the vcblog about the spectre mitigation, if anyone is
interested:
https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/
.

And since this is the first time I use this mail list, please let me know,
if I didn't use it correctly or anything I should pay attention to.

Thanks a lot,
Riff