3 ms·

Why don't more distros use the lighter weight C runtimes?

by nwah1 11y ago

daeken 11y ago
Many applications don't work with anything but glibc, so distributions don't use them; because distributions don't use them, applications don't support anything but glibc.
- tomjakubowski 11y ago
  The number of applications that rely on malloc/free being multithreaded fork safe, like glibc's allocator, is astounding. Off the top of my head, any application that uses glib and g_spawn_* is quite unportable for this reason.
pquerna 11y ago
For example, Node.js still has test case failures when running on musl on Alpine Linux: https://github.com/nodejs/docker-iojs/issues/44#issuecomment-153606107 https://github.com/nodejs/docker-iojs/issues/44#issuecomment... Most apps will work out of the box, but you can see in that issue 1+ year of various people debugging and fixing issues to just get existing test cases to pass.
ape4 11y ago
lighter weight doesn't mean fewer bugs.
ajross 11y ago
Why would that matter? This was a bug in a POSIX function that all C libraries would be required to implement.
- tomjakubowski 11y ago
  And the C libraries all implement those functions (mostly) differently. The "lighter weight" standard libraries tend to have simpler implementations of these functions, which may be easier to audit for these kinds of bugs. For example: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/getaddrinfo.c https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/pos... compare with http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...
  - JdeBP 11y ago
    Your musl libc list is too short. GNU libc puts much of getaddrinfo() into one source file. musl libc splits it across several, including: * http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri... * http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_serv.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_s... * http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... * http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_ipliteral.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_i... * http://git.musl-libc.org/cgit/musl/tree/src/network/resolvconf.c http://git.musl-libc.org/cgit/musl/tree/src/network/resolvco... See also the BSD libc implementation of getaddrinfo(): * https://svnweb.freebsd.org/base/stable/10/lib/libc/net/getaddrinfo.c?view=markup https://svnweb.freebsd.org/base/stable/10/lib/libc/net/getad... * http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/net/getaddrinfo.c?annotate=1.114&only_with_tag=MAIN http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/net/getaddr...
xorcist 11y ago
Most of them aren't audited at all. If you switched SSL library from OpenSSL after Heartbleed, odds are you went from bad to worse.

Why don't more distros use the lighter weight C runtimes?

by nwah1 11y ago

Why don't more distros use the lighter weight C runtimes?

Many applications don't work with anything but glibc, so distributions don't use them; because distributions don't use them, applications don't support anything but glibc.

tomjakubowski 11y ago
The number of applications that rely on malloc/free being multithreaded fork safe, like glibc's allocator, is astounding. Off the top of my head, any application that uses glib and g_spawn_* is quite unportable for this reason.

pquerna 11y ago

For example, Node.js still has test case failures when running on musl on Alpine Linux: https://github.com/nodejs/docker-iojs/issues/44#issuecomment-153606107 https://github.com/nodejs/docker-iojs/issues/44#issuecomment... Most apps will work out of the box, but you can see in that issue 1+ year of various people debugging and fixing issues to just get existing test cases to pass.

ape4 11y ago

lighter weight doesn't mean fewer bugs.

ajross 11y ago

Why would that matter? This was a bug in a POSIX function that all C libraries would be required to implement.

tomjakubowski 11y ago
And the C libraries all implement those functions (mostly) differently. The "lighter weight" standard libraries tend to have simpler implementations of these functions, which may be easier to audit for these kinds of bugs. For example: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/getaddrinfo.c https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/pos... compare with http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...
- JdeBP 11y ago
  Your musl libc list is too short. GNU libc puts much of getaddrinfo() into one source file. musl libc splits it across several, including: * http://git.musl-libc.org/cgit/musl/tree/src/network/getaddrinfo.c http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri... * http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_serv.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_s... * http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_name.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n... * http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_ipliteral.c http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_i... * http://git.musl-libc.org/cgit/musl/tree/src/network/resolvconf.c http://git.musl-libc.org/cgit/musl/tree/src/network/resolvco... See also the BSD libc implementation of getaddrinfo(): * https://svnweb.freebsd.org/base/stable/10/lib/libc/net/getaddrinfo.c?view=markup https://svnweb.freebsd.org/base/stable/10/lib/libc/net/getad... * http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/net/getaddrinfo.c?annotate=1.114&only_with_tag=MAIN http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/net/getaddr...

xorcist 11y ago

Most of them aren't audited at all. If you switched SSL library from OpenSSL after Heartbleed, odds are you went from bad to worse.