Mat Marcus:
I wouldn't say that it has *no* performance implications. Default settings often have large impact since many people don't take the time to learn the meaning of the various settings or tune them. In my experience, this is especially true with a complex tool like boost build.
Yes, you are right. The default does have performance implications for people who use Boost.Build for their projects. (Although I wouldn't expect that particular audience to not take the time to learn the settings.) What I said applies to the "ordinary" user of Boost. He downloads Boost, builds or installs it, then makes use of it in his own project. In this case, the state of _SECURE_SCL is determined by the user. Whatever is built or installed by default should match what most of our "ordinary" users need, so that the autolink "just works". (Or we could just build both.)