4 ms·

It is a difference of security. As one example, Debian used to be more lenient on allowing packages to vendor and statically link libraries. Around 20 years ago

by ndiddy 2y ago

It is a difference of security. As one example, Debian used to be more lenient on allowing packages to vendor and statically link libraries. Around 20 years ago, an important zlib vulnerability was found that could be exploited through malicious compressed data. Rather than just pushing out a fixed zlib package, the package maintainers had to scan the repos for all copies and versions of the zlib source, patch them individually, and test each package. To make matters worse, some packages had modified versions of zlib that needed custom variants of the patch. This is a ton of work to ask of a small group of volunteers, and leaves users vulnerable for longer.

Arnavion 2y ago
Vendored copies of libraries is a special case that's unrelated to this discussion. This discussion is about a distro whose packages dynamically link to the distro's zlib package vs a distro whose packages statically link to the distro's zlib package.
- consteval 2y ago
  I don't think vendored copies are a special case or unrelated. For example, Debian does not allow vendored copies of libs. You have to use the version provided by the system, even if it's out of date or not the one you prefer. This explicit disallowing of different code versions also greatly improves security and threat response. This recently (ish) bit hyprland, because they used a pinned version of wlroots, and the version of wlroots on Debian wouldn't work. And they couldn't just dynamically link to this pinned wlroots because that's still not around. If the version of wlroots in Debian, hypothetically, contains a vulnerability, then only one change is needed instead of two. I would argue if you allow static linking you implicitly encourage vendoring. I can't imagine such a distro where static linking is allowed, but there are 0 packages which use different lib commits.
chrsig 2y ago
> This is a ton of work to ask of a small group of volunteerss and leaves users vulnerable for longer. Perhaps consider purchasing a support contract if people's charity endangers your users.

by ndiddy 2y ago

Arnavion 2y ago

Vendored copies of libraries is a special case that's unrelated to this discussion. This discussion is about a distro whose packages dynamically link to the distro's zlib package vs a distro whose packages statically link to the distro's zlib package.

consteval 2y ago
I don't think vendored copies are a special case or unrelated. For example, Debian does not allow vendored copies of libs. You have to use the version provided by the system, even if it's out of date or not the one you prefer. This explicit disallowing of different code versions also greatly improves security and threat response. This recently (ish) bit hyprland, because they used a pinned version of wlroots, and the version of wlroots on Debian wouldn't work. And they couldn't just dynamically link to this pinned wlroots because that's still not around. If the version of wlroots in Debian, hypothetically, contains a vulnerability, then only one change is needed instead of two. I would argue if you allow static linking you implicitly encourage vendoring. I can't imagine such a distro where static linking is allowed, but there are 0 packages which use different lib commits.

chrsig 2y ago

> This is a ton of work to ask of a small group of volunteerss and leaves users vulnerable for longer. Perhaps consider purchasing a support contract if people's charity endangers your users.