3 ms·
Dynamic linking is not the only way to deliver security fixes, just one particular, limited, C-oriented solution. Note that dynamic linking is also not sufficie
by pornel 4y ago
Dynamic linking is not the only way to deliver security fixes, just one particular, limited, C-oriented solution. Note that dynamic linking is also not sufficient to change C++ templates or C header-only libraries. It shifts all of the code replacement complexity from the OS (just replace a file) onto the language and library authors (ABI compat, fragile base classes, no inlining or generics).
Rust/Cargo gives you Cargo.lock (and more precise build plans if you want) that can be used to build a database of every binary that needs to be rebuilt to update a certain dependency. Distros could use it identify and update all affected packages. There are also caching solutions to avoid rebuilding everything. It's just something they didn't have to implement before, so naturally distros prefer all new languages to fit the old unbundled-C approach instead.
- DelightOne 4y agoSo.. how do you rebuild apps without having access to their source code?
- pornel 4y agoYou ask the vendor, since they need to look after their software anyway. Don't count on closed-source abandonware to conveniently have all vulnerabilities placed in external libraries.
- DelightOne 4y agoI am talking about apps on the iPhone where Apple does not have access to developers' source code, right? We might be talking about different situations.
- pornel 4y agoUpdates of system libraries there are definitely a plus. However, besides the OS itself Apple doesn't do anything about app security. Not only they don't require unbundling, they don't even support it. Even if you use dynamic libraries in your app, they will be bundled with your app, and never updated separately. From App Store perspective there's absolutely no difference between a Swift app diligently split into frameworks and a Rust monolith library. They treat both as an opaque bundle.
- DelightOne 4y agoThat's what you would expect from the App Store as well, since why change a dynamic library when the code-controlling developer can just build a new version with his own code when the developer wants to update the app. Injecting new (the nature of not being available on app-submission) framework versions on the developers' behalf would be scary, since these versions weren't tested with the app because the versions did not exist before. As you said, ABI compat is impossible when no one cares about that much.
- tsimionescu 4y agoNote that dynamic linking is also done in Java, C#, and any dynamic language. It's not something specific to C, not by a long shot.
- taeric 4y agoI was confused by that line. I think they are mainly referring to most dynamic linking in linux? Not sure. I do think the world lost a bit by not embracing cross language linking more. Not sure when that got lost.