“Static Linking Considered Harmful” Considered Harmful

Re:“Static Linking Considered Harmful” Considered Harmful by taviso on Sunday October 03, 2021 @11:37AM (#28737998)

I've (probably?) found more linker vulnerabilities than anyone else, but don't really understand your argument. I definitely understand library search path vulnerabilities (I've literally found bugs in $ORIGIN parsing, e.g. CVE-2010-3847 was one of mine!).

We think security updates don't break API/ABI because they're backported to all previous major versions that are still actively supported. This isn't "thoughts and prayers", it's work that the packagers and maintainers do. I can't tell you how useful being able to fix a vulnerability in every program is, just think of updating every application that uses libpng on your desktop, or every server application that uses OpenSSL.

I just can't imagine wanting to give that up, because of name mangling ABI issues!

[ Parent | on HN ]

Re:“Static Linking Considered Harmful” Considered Harmful by gnufx on Sunday October 03, 2021 @01:14PM (#28738747)

I hope that puts it to rest; I can hope. Unfortunately, my experience is that people who haven't fixed multiple security problems, and probably have never heard of taviso, know a lot more about security than people who have...

[ Parent | on HN ]

Re:“Static Linking Considered Harmful” Considered Harmful by ghoward on Sunday October 03, 2021 @02:27PM (#28739359)

I have heard of taviso. That doesn't mean I can't disagree with him.

[ Parent | on HN ]

Re:“Static Linking Considered Harmful” Considered Harmful by gnufx on Sunday October 03, 2021 @06:05PM (#28740905)

Sorry, I was talking generally. I try to avoid being personal in posts.

[ Parent | on HN ]