Re: [boost] Enabling spectre mitigation in boost libraries

Subject: Re: [boost] Enabling spectre mitigation in boost libraries
From: Rene Rivera (grafikrobot_at_[hidden])
Date: 2019-04-07 02:34:12

On Sat, Apr 6, 2019 at 4:12 PM Riff J via Boost <boost_at_[hidden]>
wrote:

> Hi Robert, I get what you're saying, and we don't mind to build our
> own version. But this issue is not a regular issue, like some minor
> macros/flag we want to enable to fix some build errors. It is a
> serious one. And for mitigating it, MSVC team even released a special
> version of CRT (
> https://devblogs.microsoft.com/cppblog/spectre-mitigations-in-msvc/).
> We do have other issues while fitting boost into our build system, but
> we never reached out for those things. We only reached out for this
> one, as we believe this is the better way to fix it and can help the
> entire community. Please help reconsider it again.
>

I understand that this is a serious issue. But it's not a mass developer
problem. The majority of the software written is not impacted by this
problem as it does not allow the manipulation through external end-user
means and/or have security sensitive information to deal with. Hence such
precompile Boost libraries would see a significant lower use than the
current binaries. And the current binaries see a significant lower use than
the source code (i.e. developer compiled). And hence I don't see the value
of Boost itself providing such precompiled libraries. If Microsoft feels
this is truly an important concern that needs to be addressed Microsoft
could build Boost in that configuration and provide them for the rest of
the world to use.

-- 
-- Rene Rivera
-- Grafik - Don't Assume Anything
-- Robot Dreams - http://robot-dreams.net