3 ms·

Imagine that a shared library were upgraded, and it contained a new vulnerability. This vulnerability now automatically exposes any program that uses said said

Imagine that a shared library were upgraded, and it contained a new vulnerability. This vulnerability now automatically exposes any program that uses said said library. Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again.

dscrd 14y ago
"far easier" only because there's a huge infrastructure in the package manager that has been built over several years. And it does not always work, even though these days it most often does.
burntsushi 14y ago
> Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. Vulnerabilities are usually unforeseen. Which means that upgrading a shared library---for any reason whatsoever---could introduce a new vulnerability to all programs using that library. > On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again. It's easier, but it comes with aforementioned cost. Also, relative difficulty matters here. Maybe you haven't used Go before, but that all seems pretty simple. Particularly given the tools to analyze Go programs built right into the standard library. Also, FYI, shared Go libraries are on the roadmap. That doesn't really help, but it's certainly better than "we refuse to add it."
cmccabe 14y ago
Do you feel comfortable ripping out a shared library used by many different binaries on a production system and replacing it with a new one? I would be pretty scared to do that. I would rather replace all the binaries separately. If one of the new binaries didn't work, I could go back to the old version. I do agree that the shared library approach uses less network bandwidth, but is that really a big problem these days? Unless you're sysadminning over dialup, chances are you don't really care. The size of binaries has plateaued at a meg or two even as networks have continued to improve.
- danieldk 14y ago
  Sure, I know when the ABI changes and when not. For security fixes it's pretty safe to do. In fact, Debian Stable et al. do it all the time.

dscrd 14y ago

"far easier" only because there's a huge infrastructure in the package manager that has been built over several years. And it does not always work, even though these days it most often does.

burntsushi 14y ago

> Production systems normally only replace shared libraries to fix vulnerabilities. So, that's a non-argument. Vulnerabilities are usually unforeseen. Which means that upgrading a shared library---for any reason whatsoever---could introduce a new vulnerability to all programs using that library. > On non-production systems, it's far easier to replace one vulnerable library, than tens of vulnerable Go programs. That is, if you know which Go program was using what version of that package again. It's easier, but it comes with aforementioned cost. Also, relative difficulty matters here. Maybe you haven't used Go before, but that all seems pretty simple. Particularly given the tools to analyze Go programs built right into the standard library. Also, FYI, shared Go libraries are on the roadmap. That doesn't really help, but it's certainly better than "we refuse to add it."

cmccabe 14y ago

Do you feel comfortable ripping out a shared library used by many different binaries on a production system and replacing it with a new one? I would be pretty scared to do that. I would rather replace all the binaries separately. If one of the new binaries didn't work, I could go back to the old version. I do agree that the shared library approach uses less network bandwidth, but is that really a big problem these days? Unless you're sysadminning over dialup, chances are you don't really care. The size of binaries has plateaued at a meg or two even as networks have continued to improve.

danieldk 14y ago
Sure, I know when the ABI changes and when not. For security fixes it's pretty safe to do. In fact, Debian Stable et al. do it all the time.