4 ms·
Why do only *nix folks pull their hair out about this? On Windows programs bundle their dependencies all the time (sometimes even as shared libraries! but witho
by dataflow 6y ago
Why do only *nix folks pull their hair out about this? On Windows programs bundle their dependencies all the time (sometimes even as shared libraries! but without the independent update benefits) and hardly anybody loses sleep over it. Heck, users actually like the fact that it minimizes friction. Nobody claims it's rock-solid security, but does it need to be?
Actually, now that I wrote it above, I think I might have found an answer to my own question: while of course infosec experts will freak out about any vulnerability existing anywhere for even a shred of a nanosecond, in the real world this is really only a big deal for servers, not clients. And I'm guessing this issue affects Linux folks more because servers tend to run on Linux, with security-sensitive software exposed to the open internet all the time. Maybe we need to realize & embrace this trade-off instead of fighting it till the end of time?
(I suppose one could even argue servers don't need this either if all the packages are kept up-to-date anyway; I guess that might also be debatable, but it's beside my point.)
- GartzenDeHaes 6y agoThe unix culture comes from a shared multi-user perspective, whereas the windows point of view tends to be towards a single user desktop. In a shared environment, it's not acceptable for applications to change shared system components. Although this is maybe less important today, the culture still persists.
- dataflow 6y ago> In a shared environment, it's not acceptable for applications to change shared system components. That era is long gone on Windows (literally since XP I think). In fact I've had to do this far more on Linux than on Windows in recent memory... the latest instance ironically being the glibc CLOCK_REALTIME mess on WSL. Right now programs bundle whatever they need, and these go into the app directory (like \Program Files). e.g., I have maybe ~20 sqlite3 DLLs on my system besides the system ones. Your larger point about the culture might still be correct though, I don't know.
- oblio 6y agoYou're misreading his comment. He's saying Windows is share nothing.
- deleted 6y ago[deleted]
- staticassertion 6y ago> while of course infosec experts will freak out about any vulnerability existing anywhere for even a shred of a nanosecond, in the real world this is really only a big deal for servers, not clients I don't think that the linked article really reflects a consensus among the security community at all. I don't really find the "dynamic libraries are more secure" argument overly compelling, certainly not stated so broadly.
- SAI_Peregrinus 6y agoDynamic libraries can even introduce new vulnerabilities to everything using them.
- noobermin 6y agoPeople honestly need to push back on the constant focus on security, it's an important concern but it shouldn't make life worse for users, in some ways it is in fact being used this way.
- zlynx 6y agoWindows also has 20 years of horrible hacks where the DLL loader will intercept or binary patch old, buggy copies of bundled libraries.