5 ms·

> Imagine that Go were used to write most components on a system. One security vulnerability in one package and you don't replace just one library, you'll have

> Imagine that Go were used to write most components on a system. One security vulnerability in one package and you don't replace just one library, you'll have to reroll every binary (or package if you are maintaining a Linux distribution). Imagine that a shared library were upgraded, and it contained a new vulnerability. This vulnerability now automatically exposes any program that uses said said library. Trade offs :-) (Compiling Go is fast. Re-rolling a binary isn't a Big Deal.) > Also, since there is no version management in Go packaging, you better hope that every program uses the API of the latest or fixed version. Simplicity has a price. But there's no reason why an external tool cannot be made to handle versioning.

danieldk 14y ago
Imagine that a shared library were upgraded, and it contained a new vulnerability. This vulnerability now automatically exposes any program that uses said said library. Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again.
- dscrd 14y ago
  "far easier" only because there's a huge infrastructure in the package manager that has been built over several years. And it does not always work, even though these days it most often does.
- burntsushi 14y ago
  > Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. Vulnerabilities are usually unforeseen. Which means that upgrading a shared library---for any reason whatsoever---could introduce a new vulnerability to all programs using that library. > On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again. It's easier, but it comes with aforementioned cost. Also, relative difficulty matters here. Maybe you haven't used Go before, but that all seems pretty simple. Particularly given the tools to analyze Go programs built right into the standard library. Also, FYI, shared Go libraries are on the roadmap. That doesn't really help, but it's certainly better than "we refuse to add it."
- cmccabe 14y ago
  Do you feel comfortable ripping out a shared library used by many different binaries on a production system and replacing it with a new one? I would be pretty scared to do that. I would rather replace all the binaries separately. If one of the new binaries didn't work, I could go back to the old version. I do agree that the shared library approach uses less network bandwidth, but is that really a big problem these days? Unless you're sysadminning over dialup, chances are you don't really care. The size of binaries has plateaued at a meg or two even as networks have continued to improve.
  - danieldk 14y ago
    Sure, I know when the ABI changes and when not. For security fixes it's pretty safe to do. In fact, Debian Stable et al. do it all the time.

danieldk 14y ago

Imagine that a shared library were upgraded, and it contained a new vulnerability. This vulnerability now automatically exposes any program that uses said said library. Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again.

dscrd 14y ago
"far easier" only because there's a huge infrastructure in the package manager that has been built over several years. And it does not always work, even though these days it most often does.
burntsushi 14y ago
> Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. Vulnerabilities are usually unforeseen. Which means that upgrading a shared library---for any reason whatsoever---could introduce a new vulnerability to all programs using that library. > On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again. It's easier, but it comes with aforementioned cost. Also, relative difficulty matters here. Maybe you haven't used Go before, but that all seems pretty simple. Particularly given the tools to analyze Go programs built right into the standard library. Also, FYI, shared Go libraries are on the roadmap. That doesn't really help, but it's certainly better than "we refuse to add it."
cmccabe 14y ago
Do you feel comfortable ripping out a shared library used by many different binaries on a production system and replacing it with a new one? I would be pretty scared to do that. I would rather replace all the binaries separately. If one of the new binaries didn't work, I could go back to the old version. I do agree that the shared library approach uses less network bandwidth, but is that really a big problem these days? Unless you're sysadminning over dialup, chances are you don't really care. The size of binaries has plateaued at a meg or two even as networks have continued to improve.
- danieldk 14y ago
  Sure, I know when the ABI changes and when not. For security fixes it's pretty safe to do. In fact, Debian Stable et al. do it all the time.