“Shared libraries are not a good thing in general”

Re:“Shared libraries are not a good thing in general” by toast0 on Saturday May 01, 2021 @06:23PM (#27010422)

So if the CVE says that you need to update library L, and program A uses the thing that's broken and it's ok to update, but program B doesn't use the broken thing, but the L upgrade breaks it, CI would let you know that you're screwed before you upgrade... but you're still screwed.

It's worse if the program that needs the update also is broken by the update, of course.

[ Parent | on HN ]

Re:“Shared libraries are not a good thing in general” by ajsnigrutin on Saturday May 01, 2021 @07:09PM (#27010751)

So, what's the alternative?

Now it's your choice... you either lose B but protect the rest of the infrastructure from hackers... or you think the CVE doesn't apply to your usecase (internal thing on a testing server), and don't upgrade L to keep B working.

You can also install both versions of L. You can also patch the broken part of L out at the old version, if it's not mission critical. There's a lot of things you can do.

Having one giant binary file with everything statically compiled in is worse in every way, except for distribution-as-a-single-file (but you can already do this now, by putting the binary and the libraries in a single zip, dump everytinh in /opt/foo, and let user find the vulnerable library manually... which again, sucks.

[ Parent | on HN ]

Re:“Shared libraries are not a good thing in general” by toast0 on Saturday May 01, 2021 @07:37PM (#27010961)

If it were static libraries, you'd upgrade the package for A (which would need to be recompiled with updated L) and leave B alone. As a low priority followup, fix either B or L so they can work together again (or wait for someone else to fix and release).

Installing both versions of L is usually hard. It's one thing if it's OpenSSL[1] 1.1 vs 1.0, but if 1.0.0e is needed for security and 1.0.0d is needed for other applications, how do you make that work in Debian (or any other system that's at least somewhat mainstream)?

[1] Not to pick on OpenSSL, but it's kind of the poster child for important to pick up updates that also break things; but at least they provide security updates across branches that are trying to stay compatible.

[ Parent | on HN ]