4 ms·
How does static linking increase workload?
by someguydave 4y ago
How does static linking increase workload?
- tremon 4y agoBy multiplying the number of potentially-vulnerable copies of a library by the number of ways to detect the presence of said library and by the number of ways to upgrade said libraries when found.
- goodpoint 4y agoPlus, it makes updating an application way more difficult: you need: - the distribution to recompile and test all binaries using a vulnerable dependency [x] - users to download and update all affected binaries compared to: - the distribution patching a single package - users updating that package Imagine if OpenSSL was statically linked: even the smallest fix would require users to update half of the OS. And that would discourage both maintainer and users from doing regular updates. [x] And this is assuming that thousands of automated rebuilds are possible. In reality many statically linked languages encourage locking the versions of build dependencies, making it impossible to do just one backport of a patch.
- someguydave 4y agoWhy would you need to rebuild everywhere? Couldn’t you rebuild once in a trusted place and distribute signed binaries?
- goodpoint 4y agoDistributions have their fleet of buildbots to do the latter.
- someguydave 4y agoExactly! So what difference does it make if there is one patched package or 1,000?
- someguydave 4y agoWhat if your vendor was responsible for the fix?
- tremon 4y agoThen it increases the workload of said vendor?
- someguydave 4y agoYou also forgot to divide by the number of binaries that were compiled with non-vulnerable versions of the library.