10 ms·

> It would make this sort of vulnerability scanning much easier to do. Scanning, sure. Fixing... surely much harder than with shared libraries.

by palata 2y ago

josephg 2y ago
Only because the build tooling is less mature. It should be pretty easy to programmatically update a lock file, run the tests, and rebuild a package. For rust crates that are compiled and packaged straight from git, you could probably automate that today.
- palata 2y ago
  > It should be pretty easy to programmatically update a lock file, run the tests, and rebuild a package. You still fundamentally need to rebuild (or at least relink) and re-distribute all the packages, whereas with shared libraries... well you just update that one package.
  - kibwen 2y ago
    I hear the refrain "you'll have to rebuild your packages" a lot in these discussions, and I confess I don't see how this is a problem. Maybe it's a holdover from C and C++ veterans for whom figuring out how to build any given project is a Herculean effort, but for every other language with a first-class build system it's trivial.
    - amszmidt 2y ago
      Debian has about 59000 packages. Even rebuilding 1k of that is a significant pain on build infrastructure, specially in one go, if say a vulnerable library is found. You also now get a huge set of users who will now download these 1k of updated packages. Not to mention the utter fun of trying to understand why your system just requires maybe 100 packages to be updated… Compare to upgrading a single shared library.
      - kibwen 2y ago
        The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. In the meantime, as far as I'm concerned dynamic linking is itself a security failure, because if I run a binary I want to know exactly what code is being run, without having to worry about dynamic linking and loading nonsense inserting itself into my process.
        comex 2y ago
        > The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. At large timescales, yes. But not at timescales relevant for rapid security updates.
        amszmidt 2y ago
        They aren’t being rebuilt with that kind of frequency as you might think. They get rebuilt when a change in the package is made, not when a change in a dependency is made — which is a huge difference. There are plenty of packages that might not get an update for a long time (month, half year, … whatever their release cadence might be). Dynamic linking makes it _easier_ to handle security, including checking if your program is linking to a broken library — static linking does not have the same means. Statically linked programs don’t mean you know what is being run either, you can always dlopen() and all kind of shenanigans like Go and Rust do. What is a security nightmare is statically linked binaries, you have no clue what they are linked against.
        kibwen 2y ago
        I'm against dlopen as well. If something makes use of LD_LIBRARY_PATH, rest assured that I want it excised from my system. Reproducibly-built, fully-static binaries are what I want, ideally with an accessible SBOM embedded.
        palata 2y ago
        So all your binaries are statically linked on your system? 100%?
    - LtWorf 2y ago
      For distributions, it costs a lot of money they don't have to just be rebuilding stuff all the time. For randomly downloaded binaries from the internet it means you will most likely keep using it with the vulnerabilities for years to come.
    - palata 2y ago
      It really sounds like you see it from the point of view of a developer who has never thought about how a Linux distribution works. Yes, for you as a user it's simpler to link statically and not learn about anything else. But distros are a bit more elaborate than that.
      - josephg 2y ago
        It sounds like you see it from the point of view of a disto maintainer and never thought about how awful the experience is for software developers. I want to just depend on some specific, latest version of a library. I don’t want to have to go look at which version of that library exists in 18 different Linux distributions. I don’t want to deal with bug reports because Debian patched one of my dependencies or replaced the version I depend on with something newer or older. I’m happy for someone to update the version of my dependency if it has security patches. But the rest? A total nightmare. I’ll take cargo / npm / swift / etc style versioning every day.
        palata 2y ago
        > I don’t want to have to go look at which version of that library exists in 18 different Linux distributions. If you make open source software, the solution is simply that you should not distribute your software [1]. Let distro maintainers do it, and suddenly it's a lot easier for you. If you make proprietary software, then it's not exactly the problem of the Linux distros anymore so sure, feel free to link statically. I personally think you should do a mix of both: libraries like openssl you want to link dynamically from the system. Now some obscure dependency you may have that breaks compatibility randomly and is generally not distributed by major distros, probably you want to link them statically. But you should know that you are then responsible for them and the security issues they may bring (i.e. you should monitor them and update them regularly). [1]: https://drewdevault.com/2019/12/09/Developers-shouldnt-distribute.html https://drewdevault.com/2019/12/09/Developers-shouldnt-distr...

> It would make this sort of vulnerability scanning much easier to do. Scanning, sure. Fixing... surely much harder than with shared libraries.

by palata 2y ago

> It would make this sort of vulnerability scanning much easier to do. Scanning, sure. Fixing... surely much harder than with shared libraries.

josephg 2y ago

Only because the build tooling is less mature. It should be pretty easy to programmatically update a lock file, run the tests, and rebuild a package. For rust crates that are compiled and packaged straight from git, you could probably automate that today.

palata 2y ago
> It should be pretty easy to programmatically update a lock file, run the tests, and rebuild a package. You still fundamentally need to rebuild (or at least relink) and re-distribute all the packages, whereas with shared libraries... well you just update that one package.
- kibwen 2y ago
  I hear the refrain "you'll have to rebuild your packages" a lot in these discussions, and I confess I don't see how this is a problem. Maybe it's a holdover from C and C++ veterans for whom figuring out how to build any given project is a Herculean effort, but for every other language with a first-class build system it's trivial.
  - amszmidt 2y ago
    Debian has about 59000 packages. Even rebuilding 1k of that is a significant pain on build infrastructure, specially in one go, if say a vulnerable library is found. You also now get a huge set of users who will now download these 1k of updated packages. Not to mention the utter fun of trying to understand why your system just requires maybe 100 packages to be updated… Compare to upgrading a single shared library.
    - kibwen 2y ago
      The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. In the meantime, as far as I'm concerned dynamic linking is itself a security failure, because if I run a binary I want to know exactly what code is being run, without having to worry about dynamic linking and loading nonsense inserting itself into my process.
      - comex 2y ago
        > The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. At large timescales, yes. But not at timescales relevant for rapid security updates.
      - amszmidt 2y ago
        They aren’t being rebuilt with that kind of frequency as you might think. They get rebuilt when a change in the package is made, not when a change in a dependency is made — which is a huge difference. There are plenty of packages that might not get an update for a long time (month, half year, … whatever their release cadence might be). Dynamic linking makes it _easier_ to handle security, including checking if your program is linking to a broken library — static linking does not have the same means. Statically linked programs don’t mean you know what is being run either, you can always dlopen() and all kind of shenanigans like Go and Rust do. What is a security nightmare is statically linked binaries, you have no clue what they are linked against.
        kibwen 2y ago
        I'm against dlopen as well. If something makes use of LD_LIBRARY_PATH, rest assured that I want it excised from my system. Reproducibly-built, fully-static binaries are what I want, ideally with an accessible SBOM embedded.
        palata 2y ago
        So all your binaries are statically linked on your system? 100%?
  - LtWorf 2y ago
    For distributions, it costs a lot of money they don't have to just be rebuilding stuff all the time. For randomly downloaded binaries from the internet it means you will most likely keep using it with the vulnerabilities for years to come.
  - palata 2y ago
    It really sounds like you see it from the point of view of a developer who has never thought about how a Linux distribution works. Yes, for you as a user it's simpler to link statically and not learn about anything else. But distros are a bit more elaborate than that.
    - josephg 2y ago
      It sounds like you see it from the point of view of a disto maintainer and never thought about how awful the experience is for software developers. I want to just depend on some specific, latest version of a library. I don’t want to have to go look at which version of that library exists in 18 different Linux distributions. I don’t want to deal with bug reports because Debian patched one of my dependencies or replaced the version I depend on with something newer or older. I’m happy for someone to update the version of my dependency if it has security patches. But the rest? A total nightmare. I’ll take cargo / npm / swift / etc style versioning every day.
      - palata 2y ago
        > I don’t want to have to go look at which version of that library exists in 18 different Linux distributions. If you make open source software, the solution is simply that you should not distribute your software [1]. Let distro maintainers do it, and suddenly it's a lot easier for you. If you make proprietary software, then it's not exactly the problem of the Linux distros anymore so sure, feel free to link statically. I personally think you should do a mix of both: libraries like openssl you want to link dynamically from the system. Now some obscure dependency you may have that breaks compatibility randomly and is generally not distributed by major distros, probably you want to link them statically. But you should know that you are then responsible for them and the security issues they may bring (i.e. you should monitor them and update them regularly). [1]: https://drewdevault.com/2019/12/09/Developers-shouldnt-distribute.html https://drewdevault.com/2019/12/09/Developers-shouldnt-distr...