5 ms·

> I don't really buy that dynamic linking all the things is such a boon to security. Agreed. It's really not a panacea. When you upgrade a library, you probabl

by orra 6y ago

> I don't really buy that dynamic linking all the things is such a boon to security. Agreed. It's really not a panacea. When you upgrade a library, you probably want to restart the running applications that depend upon this. Dynamic linking won't save you. The solution is having a graph of your dependencies! IIRC, NixOS gets this right. I don't think Debian's apt did?

1MachineElf 6y ago
I would really like to know how NixOS solves this problem for things like yarn, webpack, parcel, esbuild, npm, pip, conda, cargo, stack, go modules, ruby gems, etc.
- tadfisher 6y ago
  Usually there are tools to extract the necessary dependency information (url and hash) from a package manager's lockfile and produce a fixed-output derivation so a Nix expression can reproduce the build environment. I know of yarn2nix, cargo2nix, and node2nix, and I wrote and maintain gradle2nix for JVM projects.
- mands 6y ago
  It's doesn't really, and that's the problem. There are automated tools and scripts to help, but there are always edge cases so that you end up going back to using pip for example. Nix and language package managers just don't really play well together.
ece 6y ago
There are scripts and daemons that help you determine what needs restarting[1,2]. NixOS installs can go in separate directory prefixes when there are conflicts. For Gentoo and other Linux distributions, maintainers usually won't mark something stable without resolving conflicts, and this usually means sticking to older stable version of libraries until newer versions of libraries are fully supported by all installed packages. This can definitely be more work for maintainers, and as the blog posts says, it's a sisyphean task. [1] https://manpages.debian.org/buster/debian-goodies/checkrestart.1.en.html https://manpages.debian.org/buster/debian-goodies/checkresta... [2] https://github.com/liske/needrestart https://github.com/liske/needrestart
- orra 6y ago
  Thanks, checkrestart looks useful. I wasn't aware of it. Given that it's in a goodies package though, I assume it's not integrated with apt—at least by default. I'm thinking of that apt prompt that says "There are services installed on your system which need to be restarted when certain libraries, such as libpam, libc, and libssl, are upgraded." I presume then that uses a hardcoded list of important services.
  - ece 6y ago
    I can't help with checkrestart or apt questions, but if I can plug 'needrestart -r a': it restarts services, messages outdated shells/user logins and checks for newer kernels/microcode. It will also tell you if any interpreters/containers need restarting, but YMMV here. It's never blown up for me even when restarting boot services, and should work on any distro as far as I can tell. I use it on Gentoo.
kasabali 6y ago
> When you upgrade a library, you probably want to restart the running applications that depend upon this. Dynamic linking won't save you. That's an orthogonal issue. You need to restart affected services nevertheless, whether it was linked statically or bundled in nix. I wish people stopped repeating this red herring restart argument against dynamic linking every time the topic is brought up.
hedora 6y ago
Apt has a graph of dependencies and anti-dependencies. They’ve been getting this right since the late 90s.

by orra 6y ago

1MachineElf 6y ago

I would really like to know how NixOS solves this problem for things like yarn, webpack, parcel, esbuild, npm, pip, conda, cargo, stack, go modules, ruby gems, etc.

tadfisher 6y ago
Usually there are tools to extract the necessary dependency information (url and hash) from a package manager's lockfile and produce a fixed-output derivation so a Nix expression can reproduce the build environment. I know of yarn2nix, cargo2nix, and node2nix, and I wrote and maintain gradle2nix for JVM projects.
mands 6y ago
It's doesn't really, and that's the problem. There are automated tools and scripts to help, but there are always edge cases so that you end up going back to using pip for example. Nix and language package managers just don't really play well together.

ece 6y ago

There are scripts and daemons that help you determine what needs restarting[1,2]. NixOS installs can go in separate directory prefixes when there are conflicts. For Gentoo and other Linux distributions, maintainers usually won't mark something stable without resolving conflicts, and this usually means sticking to older stable version of libraries until newer versions of libraries are fully supported by all installed packages. This can definitely be more work for maintainers, and as the blog posts says, it's a sisyphean task. [1] https://manpages.debian.org/buster/debian-goodies/checkrestart.1.en.html https://manpages.debian.org/buster/debian-goodies/checkresta... [2] https://github.com/liske/needrestart https://github.com/liske/needrestart

orra 6y ago
Thanks, checkrestart looks useful. I wasn't aware of it. Given that it's in a goodies package though, I assume it's not integrated with apt—at least by default. I'm thinking of that apt prompt that says "There are services installed on your system which need to be restarted when certain libraries, such as libpam, libc, and libssl, are upgraded." I presume then that uses a hardcoded list of important services.
- ece 6y ago
  I can't help with checkrestart or apt questions, but if I can plug 'needrestart -r a': it restarts services, messages outdated shells/user logins and checks for newer kernels/microcode. It will also tell you if any interpreters/containers need restarting, but YMMV here. It's never blown up for me even when restarting boot services, and should work on any distro as far as I can tell. I use it on Gentoo.

kasabali 6y ago

> When you upgrade a library, you probably want to restart the running applications that depend upon this. Dynamic linking won't save you. That's an orthogonal issue. You need to restart affected services nevertheless, whether it was linked statically or bundled in nix. I wish people stopped repeating this red herring restart argument against dynamic linking every time the topic is brought up.

hedora 6y ago

Apt has a graph of dependencies and anti-dependencies. They’ve been getting this right since the late 90s.