Re:“Static Linking Considered Harmful” Considered Harmful
by xgbi on Sunday October 03, 2021 @11:07AM
(#28737758)
Not related to the OP but I’ve had many issues with non standard vendors placing breaking changes in their patch/minor releases.
You think you’re updating to a relatively normal version and it actually breaks your entire production.
I’m looking at you, MySQL, docker, Mongodb, or harbor.
I’m not complaining, those are provided free of charge and we are happy when it works, but semver is really all that matters in this: either you adhere and it’s smooth sailing, or you don’t and then please don’t use semver-looking numbering.
As someone who has been a Unix sysadmin for almost twenty years now, I don't recall every installing a patch or package update that broke the ABI/API.
If one should happen to occur next week, I'll still go with leaning towards linked libraries, as their convenience out-weights (has out-weighted) the once-in-twenty-years occurrence of breakage.
> It's all thoughts and prayers. I'm a religious person, but thoughts and prayers are not a good way to do computer security.
Ditto. But "faith" and "trust" are (almost) synonyms. And I trust the updaters of libraries to be able to get out a security update in short order more than I trust the possibility of all the package maintainers that link to it to be able to coördinate a quick update.
When OpenSSL's Heartbleed occurred it was one package update and restarting of a bunch of processes (helped by the checkrestart utility in the debian-goodies package). That's a lot quicker than updating a bazillion dependents.