4 ms·

The zlib vulnerability was a huge wakeup call. Years ago I used to be in favor of statically linked, to limit dependency creep. Disk space is cheap so large bin

The zlib vulnerability was a huge wakeup call. Years ago I used to be in favor of statically linked, to limit dependency creep. Disk space is cheap so large binaries were never a concern. My favorite approach was single repository compiling optimized binaries with the specific versions of the libs wanted (in case of weird regression) and pushing these static binaries to the rest of the network. After the zlib debacle, no more: I only use that approach for very specific mission critical tools, where I do not trust ansible or even linux distributions. The sqlite 0 day may have reignited the same fears in those too young to remember grepping various zlib signatures on binaries -not just yours (you central repository can easily push new version to your network) but the other tools you don't necessary control.

flukus 8y ago
Unfortunately outside of linux distros static linking seems to be becoming more and more then new norm, especially if you include what is effectively "soft" static linking of bundling all dependencies, which suffer from the same problems. Rust is only suitable for static linking, .net core statically links and most .net projects will have all sorts of out of date dependencies, npm bundles huge dependency chains that may not be upgraded. Even in the linux distro world there is movement towards tools like docker where dependencies will often not be patched. Even the idea of stable versions of libraries with security patches seems to be a dieing one.
- whyever 8y ago
  > Rust is only suitable for static linking This is incorrect, Rust supports dynamic linking. https://doc.rust-lang.org/reference/linkage.html https://doc.rust-lang.org/reference/linkage.html
  - flukus 8y ago
    It supports it terribly. Since there's no stable ABI you have to use the same compiler version. That or be limited by the C ABI and give up most of the safety features.
    - elteto 8y ago
      This isn’t unique to Rust, C++ has the same issues when it comes to using shared libraries. You either carefully control compiling and shared library versions or you drop down to C. I don’t know any native language that can do this in a better way.

flukus 8y ago

Unfortunately outside of linux distros static linking seems to be becoming more and more then new norm, especially if you include what is effectively "soft" static linking of bundling all dependencies, which suffer from the same problems. Rust is only suitable for static linking, .net core statically links and most .net projects will have all sorts of out of date dependencies, npm bundles huge dependency chains that may not be upgraded. Even in the linux distro world there is movement towards tools like docker where dependencies will often not be patched. Even the idea of stable versions of libraries with security patches seems to be a dieing one.

whyever 8y ago
> Rust is only suitable for static linking This is incorrect, Rust supports dynamic linking. https://doc.rust-lang.org/reference/linkage.html https://doc.rust-lang.org/reference/linkage.html
- flukus 8y ago
  It supports it terribly. Since there's no stable ABI you have to use the same compiler version. That or be limited by the C ABI and give up most of the safety features.
  - elteto 8y ago
    This isn’t unique to Rust, C++ has the same issues when it comes to using shared libraries. You either carefully control compiling and shared library versions or you drop down to C. I don’t know any native language that can do this in a better way.