2 ms·
> If OpenSSL, or LibreSSL, or Go's encryption modules, or any gigantic encryption library has a vulnerability, you basically have to recompile, distribute, and
by KronisLV 5y ago
> If OpenSSL, or LibreSSL, or Go's encryption modules, or any gigantic encryption library has a vulnerability, you basically have to recompile, distribute, and then have your users download, every single god damn networking program.
Good, then you'd know that these 50 of your networking apps have each been tested by their developers' test suites and have no bugs that have been introduced as a part of this dependency. Essentially, there would be a server farm out there that'd run all of the tests so you wouldn't have to deal with prod breaking because of some new dependency version not taking every possible configuration into account.
Of course, that implies:
- that there are automated builds in place
- that there are automated tests in place
- that both of the above are run regularly, on every dependency update
- that both of the above are actually meaningful (think close to 100% functionality coverage in tests)
The current situation of relying upon dynamically linked code is only prevalent because we as an industry have decided not to even attempt to do the above. I'd say that it's a matter of not being willing to put in effort, not being willing to test our software and packages, and not being willing to develop software more slowly but thoroughly. Everyone wants "good enough" now, rather than "almost perfect" in 10 years, regardless of whether we're talking about developing software, or the tooling around it.
> But it's worse than that. Because everyone wants to ship a statically compiled Go app, nobody packages for the distros.
In my eyes, that just adds to the above - there are so many deployment targets out there, all of these different packaging systems that are used by different distros and all have numerous idiosyncrasies as opposed to a single good package manager, that people have been fed up with it and now just either ship Docker containers or expect you to download binaries.