3 ms·

The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. In the meantime, as far as I'm concerned dynamic link

by kibwen 2y ago

The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. In the meantime, as far as I'm concerned dynamic linking is itself a security failure, because if I run a binary I want to know exactly what code is being run, without having to worry about dynamic linking and loading nonsense inserting itself into my process.

comex 2y ago
> The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. At large timescales, yes. But not at timescales relevant for rapid security updates.
amszmidt 2y ago
They aren’t being rebuilt with that kind of frequency as you might think. They get rebuilt when a change in the package is made, not when a change in a dependency is made — which is a huge difference. There are plenty of packages that might not get an update for a long time (month, half year, … whatever their release cadence might be). Dynamic linking makes it _easier_ to handle security, including checking if your program is linking to a broken library — static linking does not have the same means. Statically linked programs don’t mean you know what is being run either, you can always dlopen() and all kind of shenanigans like Go and Rust do. What is a security nightmare is statically linked binaries, you have no clue what they are linked against.
- kibwen 2y ago
  I'm against dlopen as well. If something makes use of LD_LIBRARY_PATH, rest assured that I want it excised from my system. Reproducibly-built, fully-static binaries are what I want, ideally with an accessible SBOM embedded.
  - palata 2y ago
    So all your binaries are statically linked on your system? 100%?
    - kibwen 2y ago
      That's the dream. I want a system that's 100% source-available, 100% reproducible, and 100% statically-defined. Nix looks like the closest thing to that right now.
      - amszmidt 2y ago
        I don’t see how Nix is close to your dream, Nix is just like any other system and links things like any other system.. I.e. mostly avoids static linking. Debian did the strongest push for reproducible builds, and is 100% source available.

by kibwen 2y ago

comex 2y ago

> The distro repositories are being continuously rebuilt, because packages are receiving continuous updates. At large timescales, yes. But not at timescales relevant for rapid security updates.

amszmidt 2y ago

They aren’t being rebuilt with that kind of frequency as you might think. They get rebuilt when a change in the package is made, not when a change in a dependency is made — which is a huge difference. There are plenty of packages that might not get an update for a long time (month, half year, … whatever their release cadence might be). Dynamic linking makes it _easier_ to handle security, including checking if your program is linking to a broken library — static linking does not have the same means. Statically linked programs don’t mean you know what is being run either, you can always dlopen() and all kind of shenanigans like Go and Rust do. What is a security nightmare is statically linked binaries, you have no clue what they are linked against.

kibwen 2y ago
I'm against dlopen as well. If something makes use of LD_LIBRARY_PATH, rest assured that I want it excised from my system. Reproducibly-built, fully-static binaries are what I want, ideally with an accessible SBOM embedded.
- palata 2y ago
  So all your binaries are statically linked on your system? 100%?
  - kibwen 2y ago
    That's the dream. I want a system that's 100% source-available, 100% reproducible, and 100% statically-defined. Nix looks like the closest thing to that right now.
    - amszmidt 2y ago
      I don’t see how Nix is close to your dream, Nix is just like any other system and links things like any other system.. I.e. mostly avoids static linking. Debian did the strongest push for reproducible builds, and is 100% source available.