again add -fPIC so we can build PIE executables, for better security