Most security features are disabled by default (PAX, grsecurity, SELinux), and when distributions enable them, they are the first to go when admins encounter pr

Most security features are disabled by default (PAX, grsecurity, SELinux), and when distributions enable them, they are the first to go when admins encounter problems. It is then a chicken-and-egg problem when software fails in secure environments, those failures are not reported/fixed upstream but circumvented, and consequently security cannot be enabled across the board because tools break. I'd be curious if open source software would become more robust if by default the popular CI systems would enable features that do not cause any false positives but cause crashes in buggy software (memory randomization and read guards, compiler flags for detecting stack overflows).