3 ms·
> Well, no. Else software on macOS and Windows obviously wouldn't work, since those ship all their libraries along. Not exactly. For the system libraries (e.g.
by zrm 7y ago
> Well, no. Else software on macOS and Windows obviously wouldn't work, since those ship all their libraries along.
Not exactly. For the system libraries (e.g. the Windows crypto API) you effectively get one version for the whole system, and it works because the library maintainer (Microsoft) is diligent about maintaining backwards compatibility between versions. Whereas for applications that include their own copy of e.g. OpenSSL, that problem does occur there. When there is a vulnerability discovered in OpenSSL, every developer using it has to update their application instead of a library package maintainer doing it once, and if any application is no longer maintained (or just never updated to the latest version) it's now insecure indefinitely.
> And it is so much more painful to ensure that it will work correctly without any regression and with best performance for every version across e.g. Qt 5.6 to 5.14, than to just ship Qt 5.14 myself built with only the features I want with all my use cases duly tested.
You don't have to ensure it works with every version ever made, only the one the distribution ships.
This is made much easier if the library developer designates specific versions as stable and then stable distributions use those versions, because then working against the two or three actively maintained stable versions is all you need to work anywhere.
- jcelerier 7y ago> and it works because the library maintainer (Microsoft) is diligent about maintaining backwards compatibility between versions. yet people have to ship microsoft DLLs left and right since behaviour sometimes still break. One breakage is enough to convince stakeholders to do that. > When there is a vulnerability discovered in OpenSSL, every developer using it has to update their application instead of a library package maintainer doing it once, and if any application is no longer maintained (or just never updated to the latest version) it's now insecure indefinitely. On the other hand, I had software who broke, as in, core features became unoperational due to openssl distro updates and changes of default policies. My users much prefer having working potentially unsafe software in the exceptional case where the software would connect to the network (eg reading a youtube stream in VLC or something like that) that non-working software. > You don't have to ensure it works with every version ever made, only the one the distribution ships. Which is "every version ever made" because people are still rocking Debian Wheezy or Ubuntu 12.04 and want to use my software
- progval 7y ago> My users much prefer having working potentially unsafe software in the exceptional case where the software would connect to the network (eg reading a youtube stream in VLC or something like that) that non-working software. Do they, though? Or are they just unaware of what "insecure" means? Sure, if you frame it as "[technobabble about TLS certificates], click 'continue' to make the software work?", they'll chose the insecure-but-working option. But if you frame it as "your Internet Service Provider, government, and possible third-parties may be notified you are watching this video, do you want to proceed?", some of them might think twice, depending on what country they live in and what the video is.