3 ms·
> Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That used to be the norm, until a really bad (as in, remote code
by cesarb 7y ago
> Or just bundle local versions of dependencies yourself and stop relying on shared libraries.
That used to be the norm, until a really bad (as in, remote code execution) vulnerability was found in zlib, which was bundled nearly everywhere. The lesson learned was that bundled third-party libraries are a security risk, and all major distributions changed their policies to allow them only in exceptional cases.
- effie 7y agoCould you give a reference for that rationale? That does not seem to be the right lesson to be learned. They need to watch out for security holes and prepare fixes for both bundled lib and shared lib model. The more likely reason for that change seems that it is less work to update single package than all packages. But this increases security risk, because now you're running obsolete versions of those other packages.
- cesarb 7y agoI don't recall where the original discussions following the zlib incident were, but here is the current rationale from one major distribution: https://fedoraproject.org/wiki/Bundled_Libraries https://fedoraproject.org/wiki/Bundled_Libraries
- effie 7y agoThanks, this confirms my impression - the distributions are prone to think "we want to organize the software, but keeping up-to-date upstream software is too much work, so we'll use shared libraries and freeze everything to older versions". Which I understand as a pragmatic solution, but it is far from clear that this gives users more security.