Re:Static Linking Considered Harmful (2004)
by dfox on Monday September 28, 2020 @01:44PM
(#24619288)
Almost any ELF based dynamic linker has support not only for versioned library dependencies but also for versioned symbols in these libraries. The issue is mostly that some widely used libraries implement this wrong and to larger extent that people who try to ship linux binaries just link to whatever latest version they have on their build system.
Re:Static Linking Considered Harmful (2004)
by arminiusreturns on Monday September 28, 2020 @12:08PM
(#24618161)
I had always hoped the way Gobolinux approached this would start being adopted by other distros.
Re:Static Linking Considered Harmful (2004)
by Slackwise on Monday September 28, 2020 @01:43PM
(#24619276)
I'm more interested in the Nix/Guix approach, where you get the benefit of exact version linking, but also an "immutable" version controlled OS, so things like Puppet aren't necessary to manage state. (And likewise, deploy small VMs/containers with just the package manager tools without needing Docker as the entire OS state can be rebuilt using a definition file/version hash.)
Re:Static Linking Considered Harmful (2004)
by SAI_Peregrinus on Monday September 28, 2020 @01:16PM
(#24618967)
Yeah, it seems ideal. But I've not used it, yet, mostly because it's such a big change.
Re:Static Linking Considered Harmful (2004)
by jjav on Tuesday September 29, 2020 @04:31AM
(#24625322)
> you only have one system copy of any given library
This is clearly not true. Libraries are versioned and one can have unlimited versions installed. Applications can link to the most specific or most generic version desired.
Dynamic linking as implemented by most UNIX-Like OSes has a huge drawback: you only have one system copy of any given library, so all your applications are stuck using the same copy. There's no easy way to have multiple versions (say, with different features) of the same library without giving them different names. This isn't really a failing of dynamic linking, it's a failing of the OS library management model.
Dynamic linking in general has some other drawbacks: you lose Link-Time Optimization, there's more overhead at load time (and on the first call with lazy linking), and a few other performance-related issues can crop up on occasion.
There's also the issue that replacing a dynamically linked library is a lot easier than replacing a statically linked one for an attacker, so dynamic libraries can allow for vulnerabilities to be introduced (though this also is an OS issue, and there are often good mitigations for it).