@kees Yeah some went a bit heavy but I think the current ones are fine, worst case it just becomes a list that you can easily check while configuring the kernel.

Also it reminds me that https://github.com/a13xp0p0v/kconfig-hardened-check grabs a bunch of recommendations (KSPP but not only), some of them being quite hardcore to seriously questionable (say recommending against coredumps from clipos).