I'm against dlopen as well. If something makes use of LD_LIBRARY_PATH, rest assured that I want it excised from my system. Reproducibly-built, fully-static binaries are what I want, ideally with an accessible SBOM embedded.
So all your binaries are statically linked on your system? 100%?
That's the dream. I want a system that's 100% source-available, 100% reproducible, and 100% statically-defined. Nix looks like the closest thing to that right now.
I don’t see how Nix is close to your dream, Nix is just like any other system and links things like any other system.. I.e. mostly avoids static linking.
Debian did the strongest push for reproducible builds, and is 100% source available.
They get rebuilt when a change in the package is made, not when a change in a dependency is made — which is a huge difference.
There are plenty of packages that might not get an update for a long time (month, half year, … whatever their release cadence might be).
Dynamic linking makes it _easier_ to handle security, including checking if your program is linking to a broken library — static linking does not have the same means.
Statically linked programs don’t mean you know what is being run either, you can always dlopen() and all kind of shenanigans like Go and Rust do.
What is a security nightmare is statically linked binaries, you have no clue what they are linked against.