> The implication is that statically linked binaries make it easier to throw in dependencies because you neither need to worry about how to ship them nor bother

> The implication is that statically linked binaries make it easier to throw in dependencies because you neither need to worry about how to ship them nor bother with re-using the shared libraries on the system. I don't buy this argument; it's every bit as easy to `pip install` something as it is to `go get` something. > If there's a bug in Go's TLS implementation, you need to identify, recompile, and redistribute every Go application you use. Whereas if it were using the system's OpenSSL library everything would magically be fixed by a simple `apt-get upgrade` or `yum update`. I think the fix is fairly trivial; package maintainers just need to introduce vuln scanning into their automation. As soon as a security issue pops up for one of their dependencies, their automation automatically compiles a new version and publishes it to the package registry so the end user can pull it down with their next `apt-get upgrade` or `yum update` or whathaveyou.