News for hackers. Stuff that matters.

A comment on “Shared libraries are not a good thing in general”. Parent comment

Re:“Shared libraries are not a good thing in general” by ColonelPhantom on Saturday May 01, 2021 @07:10PM (#27010761)
So if there is 'proper dependency management' (what do you propose? are we too fixed in versioning, too loose?) how will you fix the next Heartbleed? Pushing updates to every single program that uses OpenSSL is a lot more cumbersome (and likely to go wrong because there is some program somewhere that did not get updated) than simply replacing the so/dll file and fixing the issue for every program on the system.

And in case your definition of proper dependency management is 'stricter', then you simply state that you depend on a vulnerable version, and fixing the issue will be far more cumbersome as it requires manual intervention as well, instead of an automated update and rebuild.

If it is looser, then it will also be far more cumbersome, as you have to watch out for breakage when trying to rebuild, and you need to update your program for the new API of the library before you can even fix the issue at all.

[ Parent | on HN ]
Re:“Shared libraries are not a good thing in general” by bjourne on Saturday May 01, 2021 @07:48PM (#27011017)
No, it is not cumbersome to reinstall every program that relies on OpenSSL. My /usr/bin directory is only 633 MB. I can download that in less than a minute. The build is handled by my distro's build farm and it would have no problem building and distributing statically linked binaries if they ever became the norm.
[ Parent | on HN ]
Re:“Shared libraries are not a good thing in general” by zxzax on Sunday May 02, 2021 @12:28AM (#27012356)
That is going back to the same issues with containers, where everything works just fine... as long as you build it from your own statically-configured repo and you rebuild the whole system every update. It's useless once you try to install any binaries from an external package source. And IMO, a world where nobody ever sends anyone else a binary is not a practical or useful one.
[ Parent | on HN ]
Re:“Shared libraries are not a good thing in general” by bjourne on Sunday May 02, 2021 @12:58PM (#27016758)
Yes? Rebuilding and (retesting!) the system on every major update is not a bad idea at all. I rarely install binaries from out-of-repo sources so that is not a great problem for me. And those I do install tend to be statically linked anyway.
[ Parent | on HN ]