4 ms·

What’s the scenario where dynamic libraries are regularly upgraded but static binaries are not? Just seems totally non-sequitur as a reason to prefer dynamic li

What’s the scenario where dynamic libraries are regularly upgraded but static binaries are not? Just seems totally non-sequitur as a reason to prefer dynamic libraries.

m4rtink 6y ago
You mean like any normal Linux distro ? Dynamic libraries installed from packages in the repositories will get updated automatically while random static binaries downloaded from the internet or built from source will just sit there perfectly stable and unchanging and progressively more vulnerable, unless the user takes an action.
- sixbrx 6y ago
  That's not static vs. dynamic though, that's "in package manager system" vs not. If package managers managed static binaries, they'd all be updated too since the package manager knows all the dependencies.
  - sergeykish 6y ago
    But what is the point of static compilation if maintainers update dependencies? Either dependencies defined by author or maintainers. Dynamic libraries just help to automate roll out. And users would find outdated versions (maybe unmaintained). Current system update dependencies automatically or allow collaboration on life support (patched application, dependencies, config). It would be good to have alternative like container or virtual machine with snapshot from the days long past. But it should be clear this is not safe.
sergeykish 6y ago
Developer who missed CVE. Not anyone has fulltime job on his project. It could result on even more shaming of open source developers (if they freeze dependencies).
- earthboundkid 6y ago
  But in this scenario, how is the dynamic library going to be upgraded?
  - sergeykish 6y ago
    * Developer who missed CVE fixed in his dependencies (if was not clear) Em, like all other packages?
    - earthboundkid 6y ago
      Say we have program X with dependency Y. X+Y is either dynamic or static. X can either have responsive maintainers or unresponsive maintainers. Y can either change to fix a bug or change to add a bug. (With Heartbleed, I remember our server was fine because we were on some ancient version of OpenSSL.) Here are the scenarios: - dynamic responsive remove bug: Positive/neutral. Team X would have done it anyway. - dynamic unresponsive remove bug: Positive. - dynamic responsive add bug: Negative. Team X will see the bug but only be able to passively warn users not to use Y version whatever. - dynamic unresponsive add bug: Negative. Users will be impacted and have to get Y to fix the error. - static responsive remove bug: Positive/neutral: Team X will incorporate the change from Y, although possibly somewhat slower (but safer). - static unresponsive remove bug: Negative. Users will have to fork X or goad them into incorportating the fix. - static responsive add bug: Positive. Users will not get the bad version of Y. - static unresponsive add bug: Positive. Users will not get the bad version of Y. Overall, dynamic is positive 1, neutral 1, negative 2, and static is positive 2, neutral 1, negative 1. Unless you can rule out Y adding bugs, static makes more sense. Dynamic is best if "unresponsive remove bug" is likely, but if X is unresponsive, maybe you should just leave X anyway.
      - sergeykish 6y ago
        Sorry, this is offtopic. You have asked how is it possible - I've answered. Dynamic vs static discussed elsewhere in the thread, no silver bullet. I prefer to optimize against unresponsive author [0]. Chose your own distro [0] https://news.ycombinator.com/item?id=23458020 https://news.ycombinator.com/item?id=23458020

What’s the scenario where dynamic libraries are regularly upgraded but static binaries are not? Just seems totally non-sequitur as a reason to prefer dynamic libraries.

m4rtink 6y ago

You mean like any normal Linux distro ? Dynamic libraries installed from packages in the repositories will get updated automatically while random static binaries downloaded from the internet or built from source will just sit there perfectly stable and unchanging and progressively more vulnerable, unless the user takes an action.

sixbrx 6y ago
That's not static vs. dynamic though, that's "in package manager system" vs not. If package managers managed static binaries, they'd all be updated too since the package manager knows all the dependencies.
- sergeykish 6y ago
  But what is the point of static compilation if maintainers update dependencies? Either dependencies defined by author or maintainers. Dynamic libraries just help to automate roll out. And users would find outdated versions (maybe unmaintained). Current system update dependencies automatically or allow collaboration on life support (patched application, dependencies, config). It would be good to have alternative like container or virtual machine with snapshot from the days long past. But it should be clear this is not safe.

sergeykish 6y ago

Developer who missed CVE. Not anyone has fulltime job on his project. It could result on even more shaming of open source developers (if they freeze dependencies).

earthboundkid 6y ago
But in this scenario, how is the dynamic library going to be upgraded?
- sergeykish 6y ago
  * Developer who missed CVE fixed in his dependencies (if was not clear) Em, like all other packages?
  - earthboundkid 6y ago
    Say we have program X with dependency Y. X+Y is either dynamic or static. X can either have responsive maintainers or unresponsive maintainers. Y can either change to fix a bug or change to add a bug. (With Heartbleed, I remember our server was fine because we were on some ancient version of OpenSSL.) Here are the scenarios: - dynamic responsive remove bug: Positive/neutral. Team X would have done it anyway. - dynamic unresponsive remove bug: Positive. - dynamic responsive add bug: Negative. Team X will see the bug but only be able to passively warn users not to use Y version whatever. - dynamic unresponsive add bug: Negative. Users will be impacted and have to get Y to fix the error. - static responsive remove bug: Positive/neutral: Team X will incorporate the change from Y, although possibly somewhat slower (but safer). - static unresponsive remove bug: Negative. Users will have to fork X or goad them into incorportating the fix. - static responsive add bug: Positive. Users will not get the bad version of Y. - static unresponsive add bug: Positive. Users will not get the bad version of Y. Overall, dynamic is positive 1, neutral 1, negative 2, and static is positive 2, neutral 1, negative 1. Unless you can rule out Y adding bugs, static makes more sense. Dynamic is best if "unresponsive remove bug" is likely, but if X is unresponsive, maybe you should just leave X anyway.
    - sergeykish 6y ago
      Sorry, this is offtopic. You have asked how is it possible - I've answered. Dynamic vs static discussed elsewhere in the thread, no silver bullet. I prefer to optimize against unresponsive author [0]. Chose your own distro [0] https://news.ycombinator.com/item?id=23458020 https://news.ycombinator.com/item?id=23458020