3 ms·

> This is where someone says "well you should just always be running the latest version of everything", which is of course infeasible on a real life system with

> This is where someone says "well you should just always be running the latest version of everything", which is of course infeasible on a real life system with thousands of installed packages. Is updating a library with thousands of dependents, without individually testing those dependents, any more feasible?

CyberShadow 5y ago
You would have to do that anyway. With static linking, you also have to rebuild those dependents and make sure their users update them as well.
- Wowfunhappy 5y ago
  I would rather the developers rebuild the dependents, test them, make any necessary fixes, and send me the updated (presumably static) binaries. As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong.
  - ris 5y ago
    And if the upstream developers are unresponsive, or only provide the bump with the latest bleeding-edge version which you can't upgrade to yet?
    - Wowfunhappy 5y ago
      On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer, it could be some other organization analogous to a distro maintainer. What matters is that someone who is familiar with the software and code base has actually tested the update in a purposeful way.
  - AussieWog93 5y ago
    As a small developer who handles my own support, I agree with this sentiment completely!!
  - xg15 5y ago
    You'll have the opposite problem though, that you have to trust every single developer to properly manage their dependencies and publish timely patches if there is a vulnerability. > As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong. Wouldn't this be the task of your distro's mainteners, not you? (Who will have familiarity with all codebases as well as options to contact the original developers if there is an unsolvable issue)
    - Wowfunhappy 5y ago
      > Wouldn't this be the task of your distro's mainteners, not you? Sure, and when they’re done, they can recompile the static binary and send me an updated copy. I don’t want to update until they’ve finished testing the dependents. At least with static binaries, I can update some of the dependents sooner as the maintainers work through their lists.
ris 5y ago
Well, it's what traditional distributions do every day. In NixOS, we try to work the test suites into the build process and rebuilds happen when any dependencies change, so I'd like to think we get (almost) the best of both worlds.
- Wowfunhappy 5y ago
  > Well, it's what traditional distributions do every day. Which coincidentally is why I'm not using Linux right now. :) A move towards static linking in the Linux world would go a long way towards changing that. (Everything I've read about NixOS seems great, thanks for helping with that—it's just that it also has a large barrier to entry.)
  - ris 5y ago
    (I'm merely a lowly maintainer in NixOS, shoulders of giants etc.)
candiddevmike 5y ago
That's the choice you're making everytime you add another dependency--you are now bound to that repo and all of it's upstreams. You need to follow along send stay on top of Caves, API deprecations, etc. I don't think people weigh this cost properly when doing a build vs integrate decision. Turns out dependency management is a lot like the "when you sleep with someone you're sleeping with everyone they've ever slept with" ideology.

CyberShadow 5y ago

You would have to do that anyway. With static linking, you also have to rebuild those dependents and make sure their users update them as well.

Wowfunhappy 5y ago
I would rather the developers rebuild the dependents, test them, make any necessary fixes, and send me the updated (presumably static) binaries. As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong.
- ris 5y ago
  And if the upstream developers are unresponsive, or only provide the bump with the latest bleeding-edge version which you can't upgrade to yet?
  - Wowfunhappy 5y ago
    On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer, it could be some other organization analogous to a distro maintainer. What matters is that someone who is familiar with the software and code base has actually tested the update in a purposeful way.
- AussieWog93 5y ago
  As a small developer who handles my own support, I agree with this sentiment completely!!
- xg15 5y ago
  You'll have the opposite problem though, that you have to trust every single developer to properly manage their dependencies and publish timely patches if there is a vulnerability. > As opposed to me, as an individual user with no familiarity with the code base, just switching out the pieces and preying nothing goes wrong. Wouldn't this be the task of your distro's mainteners, not you? (Who will have familiarity with all codebases as well as options to contact the original developers if there is an unsolvable issue)
  - Wowfunhappy 5y ago
    > Wouldn't this be the task of your distro's mainteners, not you? Sure, and when they’re done, they can recompile the static binary and send me an updated copy. I don’t want to update until they’ve finished testing the dependents. At least with static binaries, I can update some of the dependents sooner as the maintainers work through their lists.

ris 5y ago

Well, it's what traditional distributions do every day. In NixOS, we try to work the test suites into the build process and rebuilds happen when any dependencies change, so I'd like to think we get (almost) the best of both worlds.

Wowfunhappy 5y ago
> Well, it's what traditional distributions do every day. Which coincidentally is why I'm not using Linux right now. :) A move towards static linking in the Linux world would go a long way towards changing that. (Everything I've read about NixOS seems great, thanks for helping with that—it's just that it also has a large barrier to entry.)
- ris 5y ago
  (I'm merely a lowly maintainer in NixOS, shoulders of giants etc.)

candiddevmike 5y ago

That's the choice you're making everytime you add another dependency--you are now bound to that repo and all of it's upstreams. You need to follow along send stay on top of Caves, API deprecations, etc. I don't think people weigh this cost properly when doing a build vs integrate decision. Turns out dependency management is a lot like the "when you sleep with someone you're sleeping with everyone they've ever slept with" ideology.