4 ms·

Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce n

by sanbor 11y ago

Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. Debian guarantees that when you install their distro things are going to work and are kind of secure. The tradeoff of having all the software in the distro being checked by people that have tested and checked that everything works well and smooth it's going delay updating the packages. But the idea of having a distro it's something that offers you that. That someone took the work of packaging and testing, so you can install things and everything works. I think that if more software would be offered statically compiled with all the libraries (like many apps in OSX), then we would be able to try the latest release of Gimp when it's released, instead of having to waste time trying to compile from source or waiting for being included in the next release of the distro.

haddr 11y ago
Spot on. I was always puzzled why some software just can't come statically compiled. I suppose not all apps can be distributed like that, but most of them can. I can't even remember how many hours I wasted on trying to compile a new version of some program, just to learn the infinite tree of dependencies, newer versions of existing libraries required, build prefixes tweaking etc... Most of that time could have been saved.
- jhkaghjkga 11y ago
  Because any (possibly security-relevant) update to a library would mean that all software linking it statically has to be rebuilt. In reality that of course doesn't happen, so programs linking statically or including their own versions of shared libraries never get security updates for the included libraries.
  - digi_owl 11y ago
    If you want the perfect example of that problem, look to Windows. A couple of years back Microsoft discovered some kind of issue with their redistributable dlls. They patched Office etc, but could only offer a scanner that would check each and every dll to see if it was of a vulnerable version. And asked users to pester third party software providers for updates if the scanner found any.
  - sanbor 11y ago
    I wouldn't move from a package system to an "everything has to be statically compiled" system. But it would be a nice option to have when most of the software in your distro it's ok but you want to run some app without upgrading your whole distro/OS.
  - haddr 11y ago
    In the same way as you upgrade library you can just upgrade your software...
- binarycrusader 11y ago
  Because statically linking everything has several negative consequences: * increased storage space * increased memory usage * increased downtime for updates (since more files have to be updated) * increased bandwidth usage (total size of download for update) * potentially increased security risks In short, trading off all of the above to simply avoid proper release engineering and simplified dependency management is the wrong answer. Our systems need less downtime and better security; not the opposite, which is what static linking brings. That's why Solaris, as an example, does not provide static archives for almost any of the components that are provided, especially libc.
  - sanbor 11y ago
    Thank you for enumerating those downsides. Clearly I'd avoid statically linked software if I would have the option to use `apt-get install` to get that software. But in the situation that a new version of the software is released, and I think it would benefit me right now, I'd trade all those downsides for being able to use that software right now than waiting to be included in my distro (like it happened to me with Gimp some years ago). I'm plenty of memory, storage and bandwidth but not so much of time to compile it by hand. I have to admit that this is just a workaround while we find a better software release and dependency management system.
    - binarycrusader 11y ago
      But in the situation that a new version of the software is released, and I think it would benefit me right now, I'd trade all those downsides for being able to use that software right now than waiting to be included in my distro (like it happened to me with Gimp some years ago). I don't understand what static linking vs. dynamic linking has to do with waiting for gimp to be included in your distro? I'm plenty of memory, storage and bandwidth but not so much of time to compile it by hand. No one is suggesting you have to do that, but someone will have to do that, and it does require resources (time, people, hardware, etc.). I have to admit that this is just a workaround while we find a better software release and dependency management system. If by system, you're referring to technology, then I disagree. In other words, the technological constraints of today's package management systems are not the primary issue, rather it is how the software itself is being developed and managed and the available resources to do so. Ultimately though, most of this all comes about because the underlying systems that applications depend upon in a typical Linux distribution are not properly release engineered. They don't properly version the shared libraries, they don't carefully avoid incompatible changes in interfaces, and they don't have sufficient regression testing. So to me, the right answer is to fix the root of the problem, not paper over it by pretending there isn't one by essentially embedding copies of every dependency into an application. In short, start encouraging developers to reduce their dependency chains, properly release manage their software, ensure that core system components offer stable interfaces, and provide timely updates.
- rkeene2 11y ago
  AppFS ( http://appfs.rkeene.org/ http://appfs.rkeene.org/ ) aims to solve the packaging problem in a way that is very similar to this line of thinking. Software is just files on disk, rather than statically linking (and this duplicating) to libraries we can use references to the libraries (dynamic linking), the issue is the user has to install the software and its dependencies then. AppFS solves this by not having an install step. All files in all AppFS packages in all the world show up in the filesystem if you look for them. They are then cached to disk if you try to use them. So if you had a package X that depended on library Y you simply run the binary you want from X and any libraries from Y will get used. Since AppFS is a global namespace using HTTP, it has very similar semantics to the WWW, just with symlinks or ELF NEEDED entries instead of hyperlinks. So you, as a developer can publish software that depends on the software another developer publishes, and the user can fetch the software directly from you without there ever being an install step.
Ologn 11y ago
> Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. New versions of software also fix old stability and security bugs. If software became more secure with age, then the older your version of gnome screensaver, the more secure it would be ( https://www.jwz.org/blog/2015/04/i-told-you-so-again/ https://www.jwz.org/blog/2015/04/i-told-you-so-again/ ).
- sanbor 11y ago
  > New versions of software also fix old stability and security bugs. Sometimes new versions of software fix bugs, sometimes they improve stability, sometimes they introduce new bugs, sometimes they decrease the performance, sometimes they become bloatware, sometimes several of this things happen in any combination.
cmsj 11y ago
Debian doesn't guarantee you anything. "stable" isn't bug free, what you're getting is a lack of newness. "stale" would be a better choice of word. It's not necessarily better, it's just not changing.

by sanbor 11y ago

haddr 11y ago

Spot on. I was always puzzled why some software just can't come statically compiled. I suppose not all apps can be distributed like that, but most of them can. I can't even remember how many hours I wasted on trying to compile a new version of some program, just to learn the infinite tree of dependencies, newer versions of existing libraries required, build prefixes tweaking etc... Most of that time could have been saved.

jhkaghjkga 11y ago
Because any (possibly security-relevant) update to a library would mean that all software linking it statically has to be rebuilt. In reality that of course doesn't happen, so programs linking statically or including their own versions of shared libraries never get security updates for the included libraries.
- digi_owl 11y ago
  If you want the perfect example of that problem, look to Windows. A couple of years back Microsoft discovered some kind of issue with their redistributable dlls. They patched Office etc, but could only offer a scanner that would check each and every dll to see if it was of a vulnerable version. And asked users to pester third party software providers for updates if the scanner found any.
- sanbor 11y ago
  I wouldn't move from a package system to an "everything has to be statically compiled" system. But it would be a nice option to have when most of the software in your distro it's ok but you want to run some app without upgrading your whole distro/OS.
- haddr 11y ago
  In the same way as you upgrade library you can just upgrade your software...
binarycrusader 11y ago
Because statically linking everything has several negative consequences: * increased storage space * increased memory usage * increased downtime for updates (since more files have to be updated) * increased bandwidth usage (total size of download for update) * potentially increased security risks In short, trading off all of the above to simply avoid proper release engineering and simplified dependency management is the wrong answer. Our systems need less downtime and better security; not the opposite, which is what static linking brings. That's why Solaris, as an example, does not provide static archives for almost any of the components that are provided, especially libc.
- sanbor 11y ago
  Thank you for enumerating those downsides. Clearly I'd avoid statically linked software if I would have the option to use `apt-get install` to get that software. But in the situation that a new version of the software is released, and I think it would benefit me right now, I'd trade all those downsides for being able to use that software right now than waiting to be included in my distro (like it happened to me with Gimp some years ago). I'm plenty of memory, storage and bandwidth but not so much of time to compile it by hand. I have to admit that this is just a workaround while we find a better software release and dependency management system.
  - binarycrusader 11y ago
    But in the situation that a new version of the software is released, and I think it would benefit me right now, I'd trade all those downsides for being able to use that software right now than waiting to be included in my distro (like it happened to me with Gimp some years ago). I don't understand what static linking vs. dynamic linking has to do with waiting for gimp to be included in your distro? I'm plenty of memory, storage and bandwidth but not so much of time to compile it by hand. No one is suggesting you have to do that, but someone will have to do that, and it does require resources (time, people, hardware, etc.). I have to admit that this is just a workaround while we find a better software release and dependency management system. If by system, you're referring to technology, then I disagree. In other words, the technological constraints of today's package management systems are not the primary issue, rather it is how the software itself is being developed and managed and the available resources to do so. Ultimately though, most of this all comes about because the underlying systems that applications depend upon in a typical Linux distribution are not properly release engineered. They don't properly version the shared libraries, they don't carefully avoid incompatible changes in interfaces, and they don't have sufficient regression testing. So to me, the right answer is to fix the root of the problem, not paper over it by pretending there isn't one by essentially embedding copies of every dependency into an application. In short, start encouraging developers to reduce their dependency chains, properly release manage their software, ensure that core system components offer stable interfaces, and provide timely updates.
rkeene2 11y ago
AppFS ( http://appfs.rkeene.org/ http://appfs.rkeene.org/ ) aims to solve the packaging problem in a way that is very similar to this line of thinking. Software is just files on disk, rather than statically linking (and this duplicating) to libraries we can use references to the libraries (dynamic linking), the issue is the user has to install the software and its dependencies then. AppFS solves this by not having an install step. All files in all AppFS packages in all the world show up in the filesystem if you look for them. They are then cached to disk if you try to use them. So if you had a package X that depended on library Y you simply run the binary you want from X and any libraries from Y will get used. Since AppFS is a global namespace using HTTP, it has very similar semantics to the WWW, just with symlinks or ELF NEEDED entries instead of hyperlinks. So you, as a developer can publish software that depends on the software another developer publishes, and the user can fetch the software directly from you without there ever being an install step.

Ologn 11y ago

> Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. New versions of software also fix old stability and security bugs. If software became more secure with age, then the older your version of gnome screensaver, the more secure it would be ( https://www.jwz.org/blog/2015/04/i-told-you-so-again/ https://www.jwz.org/blog/2015/04/i-told-you-so-again/ ).

sanbor 11y ago
> New versions of software also fix old stability and security bugs. Sometimes new versions of software fix bugs, sometimes they improve stability, sometimes they introduce new bugs, sometimes they decrease the performance, sometimes they become bloatware, sometimes several of this things happen in any combination.

cmsj 11y ago

Debian doesn't guarantee you anything. "stable" isn't bug free, what you're getting is a lack of newness. "stale" would be a better choice of word. It's not necessarily better, it's just not changing.