4 ms·

> Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Yes, managing dependen

> Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Yes, managing dependencies is absolutely the developers’ responsibility. Choosing only well-maintained dependencies is part of that management. > Shouldn't that be the responsibility of the distribution? Not completely. You decided to take that dependency to save yourself effort. The distribution did not make that choice. The distribution may not even have a maintainer anymore. You as the developer need to do what you can ensure the “right” version of your dependency is used. This means talking to packagers and distros, and even (gasp) submitting package updates yourself if you rely on a dependency. Or just bundle local versions of dependencies yourself and stop relying on shared libraries.

kuschku 7y ago
> Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That’s what VLC did, Ubuntu/Debian patched VLC to instead use their, older, shared libraries. I’m not sure what course of action you suggest for developers in such a situation
- tatersolid 7y ago
  > I’m not sure what course of action you suggest for developers in such a situation Talk to somebody at Debian? Or submit a package update for the dependency with a security label?
  - rndgermandude 7y ago
    Let's just waste the limited time the VLC devs can spend (for free) on their project by making them chase after debian maintainers and other distros' maintainers... to get them to update a library that isn't even a VLC project... because debian decided to patch out the library version bundled with VLC in favor of their own outdated libebml package... to get a bug patched that wasn't even considered a security issue until recently... Sorry, but this sounds ridiculous to me.
cesarb 7y ago
> Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That used to be the norm, until a really bad (as in, remote code execution) vulnerability was found in zlib, which was bundled nearly everywhere. The lesson learned was that bundled third-party libraries are a security risk, and all major distributions changed their policies to allow them only in exceptional cases.
- effie 7y ago
  Could you give a reference for that rationale? That does not seem to be the right lesson to be learned. They need to watch out for security holes and prepare fixes for both bundled lib and shared lib model. The more likely reason for that change seems that it is less work to update single package than all packages. But this increases security risk, because now you're running obsolete versions of those other packages.
  - cesarb 7y ago
    I don't recall where the original discussions following the zlib incident were, but here is the current rationale from one major distribution: https://fedoraproject.org/wiki/Bundled_Libraries https://fedoraproject.org/wiki/Bundled_Libraries
    - effie 7y ago
      Thanks, this confirms my impression - the distributions are prone to think "we want to organize the software, but keeping up-to-date upstream software is too much work, so we'll use shared libraries and freeze everything to older versions". Which I understand as a pragmatic solution, but it is far from clear that this gives users more security.

kuschku 7y ago

> Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That’s what VLC did, Ubuntu/Debian patched VLC to instead use their, older, shared libraries. I’m not sure what course of action you suggest for developers in such a situation

tatersolid 7y ago
> I’m not sure what course of action you suggest for developers in such a situation Talk to somebody at Debian? Or submit a package update for the dependency with a security label?
- rndgermandude 7y ago
  Let's just waste the limited time the VLC devs can spend (for free) on their project by making them chase after debian maintainers and other distros' maintainers... to get them to update a library that isn't even a VLC project... because debian decided to patch out the library version bundled with VLC in favor of their own outdated libebml package... to get a bug patched that wasn't even considered a security issue until recently... Sorry, but this sounds ridiculous to me.

cesarb 7y ago

> Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That used to be the norm, until a really bad (as in, remote code execution) vulnerability was found in zlib, which was bundled nearly everywhere. The lesson learned was that bundled third-party libraries are a security risk, and all major distributions changed their policies to allow them only in exceptional cases.

effie 7y ago
Could you give a reference for that rationale? That does not seem to be the right lesson to be learned. They need to watch out for security holes and prepare fixes for both bundled lib and shared lib model. The more likely reason for that change seems that it is less work to update single package than all packages. But this increases security risk, because now you're running obsolete versions of those other packages.
- cesarb 7y ago
  I don't recall where the original discussions following the zlib incident were, but here is the current rationale from one major distribution: https://fedoraproject.org/wiki/Bundled_Libraries https://fedoraproject.org/wiki/Bundled_Libraries
  - effie 7y ago
    Thanks, this confirms my impression - the distributions are prone to think "we want to organize the software, but keeping up-to-date upstream software is too much work, so we'll use shared libraries and freeze everything to older versions". Which I understand as a pragmatic solution, but it is far from clear that this gives users more security.