4 ms·

> This comes up a lot, but how often do you end up in a scenario where there's a critical security hole and you _can't_ patch it because one program somewhere i

by fao_ 5y ago

> This comes up a lot, but how often do you end up in a scenario where there's a critical security hole and you _can't_ patch it because one program somewhere is incompatible with the new version? Maybe even a program that isn't security critical? Talking about user usecases, every time I play a game on Steam. At the very least there are GNU TLS versioning problems. That's why steam packages it's own library system containing multiple versions of the same library -- thus rendering all of the benefits of shared libraries completely null. One day, game developers will package static binaries, and the compiler will be able to rip out all of the functions that they don't use, and I won't have to have 5 - 20 copies of the same library on my system just sitting around -- worse if you have multiple steam installs in the same /home partition because you're a distro hopper. One day...

ronsor 5y ago
> the compiler will be able to rip out all of the functions that they don't use Link-time optimization is already a thing. It's sad it doesn't seem to be used more often.
- yakubin 5y ago
  Even without LTO, linker will discard object files that aren't used (on Linux a static library is just an AR archive of object files). It's just a different level of granularity.
  - floatboth 5y ago
    You can get better granularity – build with -ffunction-sections, link with --gc-sections. LTO is really a much bigger deal, the main reason to use it is not throwing unused stuff away, but inlining across all the things.
- MereInterest 5y ago
  Yes, but LTO doesn't apply across shared object libraries. Suppose I write a video game that uses DirectX for graphics, but I don't use the DirectX Raytracing feature at all. Because of DLL hell, I'm going to be shipping my own version of the DirectX libraries, ones that I know my video game is compatible with. Those are going to be complete DirectX libraries, including the Raytracing component, even though I don't use it at all in my game. No amount of LTO can remove it, because theoretically that same library could be used by other programs. On the other hand, if I am static linking, then there are no other programs that could use the static library. (Or, rather, if they do, they have their own embedded copy.) The LTO is free to remove any functions that I don't need, reducing the total amount that I need to ship.
  - hdhrnnrkrkf 5y ago
    DirectX is a bad example, it's now a part of Windows and you don't ship it anymore.
    - MereInterest 5y ago
      Good point (and shows that I am not a video game developer). I had tried to pick DirectX as something that would follow fao_'s example of game developers. The point still holds in the general case, though as you pointed out, not in the case of DirectX in particular.
felipelemos 5y ago
Well, you will have multiple copies of the same library in your system, but they will be just exclusive for each application.
- fao_ 5y ago
  Well, not really. The compiler is able to optimize the contents of the library and integrate it with the program. i.e. some functions will just be inlined, and that means that those functions won't exist in the same form after other optimizations are applied (Like, maybe the square root function has specific object code, but after inlining the compiler is able to use the context to minify and transform it further). So it's actually less wasteful.
rsj_hn 5y ago
There's a big difference between production installs and personal systems or hobbyist systems. Think, there are lots of businesses running Cobol on mainframes, there are machine shops running on Windows XP, there are big companies still running java 8 and python2. When you have a system that is basically frozen, you end up with catastrophic failure where to upgrade X you need to upgrade Y which requires upgrading Z, etc. You'd be surprised what even big named companies are running in their datacenters, stuff that has to work, is expensive to upgrade, and by virtue of being expensive to upgrade it ends up not being upgraded to the point where any upgrade becomes a breaking change. And at the rate technology changes, even a five year old working system quickly becomes hopelessly out of date. Now imagine a 30 year old system in some telco. These are such different use cases that I think completely different standards and processes as well as build systems are going to become the norm for big critical infrastructure versus what is running on your favorite laptop.
soedirgo 5y ago
> One day, game developers will package static binaries Wouldn't you still need at least runtime linking (dlopen) to link to OpenGL/Vulkan/etc.?
- fao_ 5y ago
  I've seen independent OpenGL libraries packaged along with games, so, I wouldn't think so no.
  - account42 5y ago
    I doubt that you did since OpenGL implementations are hardware-specific. Perhaps you mean utility libraries building on top of OpenGL such as GLEW or GLUT. Some libraries (OpenGL, Vulkan, ALSA, ..) the shared library provides the lowest stable cross-hardware interface there is so linking the library makes no sense.

by fao_ 5y ago

ronsor 5y ago

> the compiler will be able to rip out all of the functions that they don't use Link-time optimization is already a thing. It's sad it doesn't seem to be used more often.

yakubin 5y ago
Even without LTO, linker will discard object files that aren't used (on Linux a static library is just an AR archive of object files). It's just a different level of granularity.
- floatboth 5y ago
  You can get better granularity – build with -ffunction-sections, link with --gc-sections. LTO is really a much bigger deal, the main reason to use it is not throwing unused stuff away, but inlining across all the things.
MereInterest 5y ago
Yes, but LTO doesn't apply across shared object libraries. Suppose I write a video game that uses DirectX for graphics, but I don't use the DirectX Raytracing feature at all. Because of DLL hell, I'm going to be shipping my own version of the DirectX libraries, ones that I know my video game is compatible with. Those are going to be complete DirectX libraries, including the Raytracing component, even though I don't use it at all in my game. No amount of LTO can remove it, because theoretically that same library could be used by other programs. On the other hand, if I am static linking, then there are no other programs that could use the static library. (Or, rather, if they do, they have their own embedded copy.) The LTO is free to remove any functions that I don't need, reducing the total amount that I need to ship.
- hdhrnnrkrkf 5y ago
  DirectX is a bad example, it's now a part of Windows and you don't ship it anymore.
  - MereInterest 5y ago
    Good point (and shows that I am not a video game developer). I had tried to pick DirectX as something that would follow fao_'s example of game developers. The point still holds in the general case, though as you pointed out, not in the case of DirectX in particular.

felipelemos 5y ago

Well, you will have multiple copies of the same library in your system, but they will be just exclusive for each application.

fao_ 5y ago
Well, not really. The compiler is able to optimize the contents of the library and integrate it with the program. i.e. some functions will just be inlined, and that means that those functions won't exist in the same form after other optimizations are applied (Like, maybe the square root function has specific object code, but after inlining the compiler is able to use the context to minify and transform it further). So it's actually less wasteful.

rsj_hn 5y ago

There's a big difference between production installs and personal systems or hobbyist systems. Think, there are lots of businesses running Cobol on mainframes, there are machine shops running on Windows XP, there are big companies still running java 8 and python2. When you have a system that is basically frozen, you end up with catastrophic failure where to upgrade X you need to upgrade Y which requires upgrading Z, etc. You'd be surprised what even big named companies are running in their datacenters, stuff that has to work, is expensive to upgrade, and by virtue of being expensive to upgrade it ends up not being upgraded to the point where any upgrade becomes a breaking change. And at the rate technology changes, even a five year old working system quickly becomes hopelessly out of date. Now imagine a 30 year old system in some telco. These are such different use cases that I think completely different standards and processes as well as build systems are going to become the norm for big critical infrastructure versus what is running on your favorite laptop.

soedirgo 5y ago

> One day, game developers will package static binaries Wouldn't you still need at least runtime linking (dlopen) to link to OpenGL/Vulkan/etc.?

fao_ 5y ago
I've seen independent OpenGL libraries packaged along with games, so, I wouldn't think so no.
- account42 5y ago
  I doubt that you did since OpenGL implementations are hardware-specific. Perhaps you mean utility libraries building on top of OpenGL such as GLEW or GLUT. Some libraries (OpenGL, Vulkan, ALSA, ..) the shared library provides the lowest stable cross-hardware interface there is so linking the library makes no sense.