Hardened compiler flags VS automatic security patches?

Question

I noticed that a few select pieces of software in the Long Term Support repository for my Operating System, have not been compiled with PIE, or Immediate binding (for example).

In the opinion of those here on serverfault, would it be more security-wise to recompile these select pieces of software, using security aware flags and features within GCC? Or is it more important to keep the software as up-to-date as possible from the upstream repository, trusting in their decisions when they compiled the package?

Of course "both" is likely the preferred answer.. But realistically, and the only reason I still have not attempted recompilation of mission critical applications, is that I would have to subsequently place custom built DEB packages on Hold (within the package manager) so that custom builds are not overwritten by a future package update without my knowledge.

This way, i'd have to evaluate how important or security related the update was. if needed, rebuild from source, package, and install said update-

Simply put, does the benefit of custom compilation outweigh the benefit of on demand security patches? any suggestions?

and on a side note; is the package maintainer typically responsible for compiling with certain security flags enabled (such as PIE)? or it this typically done at the whim of the upstream repository (I.E the Debian/Ubuntu Distro Maintainers)? should this influence my decision?

Answer 1

It is a Release Goal for the Debian Project to "update as many packages as possible to use security hardening build flags via dpkg-buildflags". When will this task be completed, is not stated in their wiki. So, to answer one of your questions, this is a decision made at the distro level, that maintainers need to implement. In the case of Debian, as you know, maintainers are volunteers.

If this is a pure security concern, you might as well contact the maintainers of those packages, or fill a bug report against them, ideally providing a patch.

If this is a business decision, you'd need to take into account the time invested in recompiling, packaging and distributing such pieces of software until they are fixed in your distribution, or use another distribution that already has implemented these security measures.