5 ms·

>system dynamic linking made sense I too look forwards to having to manually updated all security patches for each binary in the system.

axaxs 7y ago
Would you rather each update of said binary be dependent on the author or some volunteer? That's how you get Debian stable.. No thanks.
- diffeomorphism 7y ago
  On the author of the single vulnerable library instead of the hundreds of authors of projects making use of it, yes please. The fact that things like flatpak, snap, nix all explicitly try to address this problem with platforms/base layers/grafting etc. is very telling. They are all a trade off of your security vs. the dev's convenience, which might be necessary to succeed.
- stOneskull 7y ago
  I love Debian stable for this. And then we get MX, Deepin, Ubuntu and Mint..
- e2le 7y ago
  I prefer the quality control that something like Debian stable provides, developers aren't always interested in packaging their application the right way or are just ignorant of how to package their application for one of many distros all with their own package format and tools.
wmf 7y ago
The brave new OSTree/Flatpak world needs build systems that know how to do security updates. There's a lot of work in this area in the Dockerverse; maybe it will cross over.
- michaelmrose 7y ago
  What happens is that half of your security updates never happen because it depends on individual app providers who have no skin in the game to do so this is unfixable unless apps that are insecure aren't installable.
  - wwright 7y ago
    Before Silverblue, Red Hat and Fedora maintain a list of custom build scripts for all packages that apply patches and security updates. After Silverblue, when they run in Flatpaks, they can still maintain build scripts that achieve the same thing. The distribution itself can even maintain a common base image for all flatpaks in the official repos, retaining all of the code sharing of existing systems, but with the benefit of a more robust and modular solution when they need to make exceptions. End users will also be able to more reliably use applications that are not supported by the distribution proper.
danieldk 7y ago
This is what Nix gets right. Even if static linking is used, if some dependency is updated, all packages that have that dependency in its transitive closure get recompiled.
- saagarjha 7y ago
  Sounds a bit inconvenient if something low level gets changed, no? If libc changes you’re in for a day of builds…
  - e2le 7y ago
    Who says you need to compile anything? Nix allows you to download the binaries from their "build cache" if you so choose to, the same is true for guix.
    - hedora 7y ago
      But then, you’re downloading GB of stuff, just like windows update.
- ComputerGuru 7y ago
  FreeBSD’s pkg does that, but they’re recompiled in the package server and you just download the updated binaries built against those releases. It is very fast.

axaxs 7y ago

Would you rather each update of said binary be dependent on the author or some volunteer? That's how you get Debian stable.. No thanks.

diffeomorphism 7y ago
On the author of the single vulnerable library instead of the hundreds of authors of projects making use of it, yes please. The fact that things like flatpak, snap, nix all explicitly try to address this problem with platforms/base layers/grafting etc. is very telling. They are all a trade off of your security vs. the dev's convenience, which might be necessary to succeed.
stOneskull 7y ago
I love Debian stable for this. And then we get MX, Deepin, Ubuntu and Mint..
e2le 7y ago
I prefer the quality control that something like Debian stable provides, developers aren't always interested in packaging their application the right way or are just ignorant of how to package their application for one of many distros all with their own package format and tools.

wmf 7y ago

The brave new OSTree/Flatpak world needs build systems that know how to do security updates. There's a lot of work in this area in the Dockerverse; maybe it will cross over.

michaelmrose 7y ago
What happens is that half of your security updates never happen because it depends on individual app providers who have no skin in the game to do so this is unfixable unless apps that are insecure aren't installable.
- wwright 7y ago
  Before Silverblue, Red Hat and Fedora maintain a list of custom build scripts for all packages that apply patches and security updates. After Silverblue, when they run in Flatpaks, they can still maintain build scripts that achieve the same thing. The distribution itself can even maintain a common base image for all flatpaks in the official repos, retaining all of the code sharing of existing systems, but with the benefit of a more robust and modular solution when they need to make exceptions. End users will also be able to more reliably use applications that are not supported by the distribution proper.

danieldk 7y ago

This is what Nix gets right. Even if static linking is used, if some dependency is updated, all packages that have that dependency in its transitive closure get recompiled.

saagarjha 7y ago
Sounds a bit inconvenient if something low level gets changed, no? If libc changes you’re in for a day of builds…
- e2le 7y ago
  Who says you need to compile anything? Nix allows you to download the binaries from their "build cache" if you so choose to, the same is true for guix.
  - hedora 7y ago
    But then, you’re downloading GB of stuff, just like windows update.
ComputerGuru 7y ago
FreeBSD’s pkg does that, but they’re recompiled in the package server and you just download the updated binaries built against those releases. It is very fast.