[gentoo-dev] Re: Improve the security of the default profile

[Martin Vaeth <vaeth@mathematik.uni-wuerzburg.de>]

Pacho Ramos <pacho@gentoo.org> wrote:
>
> Is there any kind of information about performance penalty of
> -fstack-protector? I have googled some time and there are various
> estimations (from ~2 to ~8%), but I have no idea what have they checked
> exactly.

This depends extremely on the code: Most functions will be unchanged,
and only a few functions with possibly dangerous code get a fixed
impact whenever they are called. Whether they are called frequently
or not cannot be said in general.

> looks to me like it will have impact but "not too much" :/

Of course, it will have impact, but it is more theoretical than practical.

> For some recent computers I would probably use it,
> but for older ones, I am not sure if will be happy
> with that additional impact :|

On my old Pentium III laptop it makes no difference for my applications
which can be felt. Of course, if you have a special time-critical
application which just was on the limit, things might be different.
However,in such cases you would also use things like -DNDEBUG which one
would not choose as a default just because it gives some minimal
performance enhancement.