Re:Memory safe ‘curl’ for a more secure internet
by asveikau on Friday October 09, 2020 @05:13PM
(#24734503)
But each one of these dependencies is pretty consciously and manually added, most of the time. In new code, to introduce a new one usually requires thought, and that creates a culture of caution.
Also if you are dynamic linking, ldd(1) can give you a pretty good picture.
Re:Memory safe ‘curl’ for a more secure internet
by pixel_fcker on Friday October 09, 2020 @06:06PM
(#24734903)
And a simple ‘cargo tree‘ will show you the tree of dependencies for a crate, nicely formatted.
Re:Memory safe ‘curl’ for a more secure internet
by jdright on Friday October 09, 2020 @12:46PM
(#24731757)
This. Take even CURL as an example, try to list its dependencies and you'll see how harder it is.
Re:Memory safe ‘curl’ for a more secure internet
by tick_tock_tick on Friday October 09, 2020 @04:43PM
(#24734245)
libc that's it. Every other dependency for curl is optional.....
Re:Memory safe ‘curl’ for a more secure internet
by jdright on Friday October 09, 2020 @08:40PM
(#24735792)
Try it. If you do not use any "optional" dependency it becomes pretty limited, almost useless for anything serious (eg. zlib, ssl)
Re:Memory safe ‘curl’ for a more secure internet
by asveikau on Saturday October 10, 2020 @12:22AM
(#24736667)
Zlib is pretty small.
TLS implementions are often giant hairballs but one that many things depend on. You can think of it as a somewhat "system level" dependency.
Re:Memory safe ‘curl’ for a more secure internet
by jdright on Tuesday October 13, 2020 @02:46PM
(#24768732)
Being small is not in the question. Being there is. Otherwise we wouldn't be here discussing all hyper dependencies in detail as some of these are a lot smaller than zlib.
Re:Memory safe ‘curl’ for a more secure internet
by asveikau on Monday October 19, 2020 @08:19PM
(#24832586)
I am late to reply. What I mean to say is zlib is a small self contained dependency, suitable for static linking, and no major dependency of its own, just math. A lot of more modern libraries and languages tend to have their small dependencies pull in a massive hydra of dependencies.
Let's say you open up a new C codebase: What are its dependencies? You'll have to hunt through its README (hopefully it's up to date!), other build instructions, maybe CMake, maybe some custom build system, etc.
What version of dependencies does it use? If the code has been vendored, you at least know what code its using - but where do you look for updates to that code? Do you manually go out to wherever it was copied from now and then and look for updates? If the code isn't vendored, then how was it installed? From the package manager? If so, what operating system and version was used during development? If its not from a package, its might have been downloaded and installed manually? Again, where was it downloaded from? Where was it installed? What options did it use when it was compiled?
How do you handle transitive dependencies? Probably by hand. How well documented are they?
C suffers plenty of dependency issues.