> Sure, most security fixes do not break the ABI or API. But it only takes one, and then you have a security issue. As someone who has been a Unix sysadmin for

> Sure, most security fixes do not break the ABI or API. But it only takes one, and then you have a security issue. As someone who has been a Unix sysadmin for almost twenty years now, I don't recall every installing a patch or package update that broke the ABI/API. If one should happen to occur next week, I'll still go with leaning towards linked libraries, as their convenience out-weights (has out-weighted) the once-in-twenty-years occurrence of breakage. > It's all thoughts and prayers. I'm a religious person, but thoughts and prayers are not a good way to do computer security. Ditto. But "faith" and "trust" are (almost) synonyms. And I trust the updaters of libraries to be able to get out a security update in short order more than I trust the possibility of all the package maintainers that link to it to be able to coördinate a quick update. When OpenSSL's Heartbleed occurred it was one package update and restarting of a bunch of processes (helped by the checkrestart utility in the debian-goodies package). That's a lot quicker than updating a bazillion dependents.