3 ms·
Tracking security incidents. If every piece of software uses the system-wide copy of a vulnerable library, you only need to patch that library and the entire sy
by tremon 6y ago
Tracking security incidents. If every piece of software uses the system-wide copy of a vulnerable library, you only need to patch that library and the entire system is safe. For every embedded copy of that library, a separate patch and release must be made. That's a lot of management overhead.
- debiandev 6y agoYou are confusing static linking with embedding library sources.
- pabs3 6y agoBoth static linking and embedded copies have similar issues. With static linking you have to track where the static library ended up (recursively) and then issue rebuilds in the correct order for all packages that contain the static library (directly or indirectly). With embedded copies you have to search the source code archive for the copies and then patch and rebuild each copy. In some ways static linking is more complicated to deal with, due to the case that the static library ends up in some other static library.