News for hackers. Stuff that matters.
Re:Electron: The Bad Parts by nugator on Saturday September 16, 2017 @02:29PM (#15265910)
What do you mean should be hashed? Each library?
Re:Electron: The Bad Parts by api on Saturday September 16, 2017 @02:36PM (#15265948)
Yes. Then add a service on the OS that fetches the libraries for any binary. It's not a complicated thing. It's been obvious to me for years that this is how exact version linking should work.

Linux at least has library versioning so this is less of a problem. Windows has foo.dll and foo.dll and foo.dll, so pretty much the only way is to ship your own foo.dll.

Re:Electron: The Bad Parts by paulddraper on Sunday September 17, 2017 @12:41PM (#15270418)
There are schemes like this, e.g. Nix.

I like it though it not without any disadvantage.

It will be challenging to upgrade OpenSSL after a discovered vulnerability.