Re:Stali: A new static Linux distribution
by jstimpfle on Wednesday September 28, 2016 @10:12AM
(#12597734)
Is it practical to make diffs of recompiled binaries? Don't you need to compile to position independent code? Or otherwise make sure that most of the code's position does not change when some statically linked library changes?
Re:Stali: A new static Linux distribution
by jdc0589 on Wednesday September 28, 2016 @10:33AM
(#12597932)
Slightly different comparison, but I remember some google project to do this for shipping updates a while ago. Must have been for android, but I can't remember.
Re:Stali: A new static Linux distribution
by infogulch on Wednesday September 28, 2016 @10:57AM
(#12598131)
Chrome, actually. Called Courgette [1]. This would actually be really awesome to apply to statically-linked distro updates.
[1]: https://www.chromium.org/developers/design-documents/softwar...
The point is: in the context of a Linux distro, it's not true that you need dynamic linking to be able to do security patches effectively. What users do is to run the package manager to update the system; the package manager can provide updates to static binaries as well (and do it efficiently). It's just a matter of tooling; current package managers are designed around the concept of dynamic libraries, but they could be updated.