4 ms·

This argument comes up every time this discussion comes up (on flatpaks etc). And for almost all systems I’d say “yes, absolutely”. One headache over another.

This argument comes up every time this discussion comes up (on flatpaks etc). And for almost all systems I’d say “yes, absolutely”. One headache over another. What’s to guarantee applications haven’t statically linked a library (in whatever version) rather than linked a “system” version of a library? With the dynamic one you have both problems…

LtWorf 4y ago
Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using. > What’s to guarantee applications haven’t statically linked a library (in whatever version) rather than linked a “system” version of a library? It's easy to see which commands are given to the compiler and if there is a copied library if you have sources.
- gravypod 4y ago
  > Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using. If we made all builds reproducible (like oasis) we could setup an automated trusted system that does builds verifiably automatically (like what Nix has).
  - goodpoint 4y ago
    There are already trusted sources of software packages that provide security updates: traditional Linux distributions. Doing automated, local patching and rebuilding is far from enough. You need experts to correctly backport patches and test them thoroughly.
    - bayindirh 4y ago
      No, no… We need to move very fast, and break all the things. Tradition and conservatism is not the way. We need to compile everything and anything. Change the paradigm, break the status quo! Oh, just like Gentoo, Slackware and LFS. ;) Seriously, maybe we shouldn’t ignore history and learn why things are like this today.
    - LtWorf 4y ago
      People bashing distributions seem to ignore that the alternative is the google play store.
  - bayindirh 4y ago
    Which reproducible builds project is striving to do for quite some time. It’s not just a simple switch you flick and recompile.
- alkonaut 4y ago
  Yes but in general a system can safely be assumed to contain At least some software which was built elsewhere. Especially in more proprietary worlds like on Windows and MacOS.
arinlen 4y ago
> And for almost all systems I’d say “yes, absolutely”. Do you even understand that you are advocating in favour of perpetually vulnerable systems? Let's not touch the fact that there are vague and fantastic claims about shared libraries being this never ending sources of problems (which no one actually experiences) that when asked to elaborate the best answer is wand waving and hypotheticals and non-sequiturs. With this fact out if the way, what is your plan to update all downstream dependencies when a vulnerability is identified?
- csande17 4y ago
  Before you decry statically linked systems as "perpetually vulnerable", I'd advise you take a look at the number of privilege escalation vulnerabilities caused by LD_PRELOAD alone.
  - hedora 4y ago
    That's like claiming that a leaky sump pump sank the titanic. Linux has never been anywhere close to resistant to privilege escalation bugs.
  - arinlen 4y ago
    > Before you decry statically linked systems as "perpetually vulnerable" But statically linked systems are perpetually vulnerable by design, aren't they? I mean, what's your plan to fix a vulnerable dependency once a patch is available? Are you tracking each and every dependency that directly or indirectly consumes the vulnerable library? Are you hoping to have access to their source code, regardless of where they came from, and rebuild all libraries and applications? Because with shared libraries, all it takes to patch a vulnerable library is to update just the one lib, and all downstream consumers are safe. What's your solution for this problem? Do you have any at all?
    - csande17 4y ago
      What's your plan if fixing a vulnerability requires changing the size of a struct?

LtWorf 4y ago

Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using. > What’s to guarantee applications haven’t statically linked a library (in whatever version) rather than linked a “system” version of a library? It's easy to see which commands are given to the compiler and if there is a copied library if you have sources.

gravypod 4y ago
> Flatpaks won't be automatically recompiled though. It might take years before they bump whatever vulnerable thing they are using. If we made all builds reproducible (like oasis) we could setup an automated trusted system that does builds verifiably automatically (like what Nix has).
- goodpoint 4y ago
  There are already trusted sources of software packages that provide security updates: traditional Linux distributions. Doing automated, local patching and rebuilding is far from enough. You need experts to correctly backport patches and test them thoroughly.
  - bayindirh 4y ago
    No, no… We need to move very fast, and break all the things. Tradition and conservatism is not the way. We need to compile everything and anything. Change the paradigm, break the status quo! Oh, just like Gentoo, Slackware and LFS. ;) Seriously, maybe we shouldn’t ignore history and learn why things are like this today.
  - LtWorf 4y ago
    People bashing distributions seem to ignore that the alternative is the google play store.
- bayindirh 4y ago
  Which reproducible builds project is striving to do for quite some time. It’s not just a simple switch you flick and recompile.
alkonaut 4y ago
Yes but in general a system can safely be assumed to contain At least some software which was built elsewhere. Especially in more proprietary worlds like on Windows and MacOS.

arinlen 4y ago

> And for almost all systems I’d say “yes, absolutely”. Do you even understand that you are advocating in favour of perpetually vulnerable systems? Let's not touch the fact that there are vague and fantastic claims about shared libraries being this never ending sources of problems (which no one actually experiences) that when asked to elaborate the best answer is wand waving and hypotheticals and non-sequiturs. With this fact out if the way, what is your plan to update all downstream dependencies when a vulnerability is identified?

csande17 4y ago
Before you decry statically linked systems as "perpetually vulnerable", I'd advise you take a look at the number of privilege escalation vulnerabilities caused by LD_PRELOAD alone.
- hedora 4y ago
  That's like claiming that a leaky sump pump sank the titanic. Linux has never been anywhere close to resistant to privilege escalation bugs.
- arinlen 4y ago
  > Before you decry statically linked systems as "perpetually vulnerable" But statically linked systems are perpetually vulnerable by design, aren't they? I mean, what's your plan to fix a vulnerable dependency once a patch is available? Are you tracking each and every dependency that directly or indirectly consumes the vulnerable library? Are you hoping to have access to their source code, regardless of where they came from, and rebuild all libraries and applications? Because with shared libraries, all it takes to patch a vulnerable library is to update just the one lib, and all downstream consumers are safe. What's your solution for this problem? Do you have any at all?
  - csande17 4y ago
    What's your plan if fixing a vulnerability requires changing the size of a struct?