4 ms·

Please see: http://www.akkadia.org/drepper/no_static_linking.html http://www.akkadia.org/drepper/no_static_linking.html

deleted 13y ago
[deleted]
barrkel 13y ago
There's only one minor problem; DLL hell. As long as none of your applications break when you update their shared dependencies, everything's fine. The package management system generally takes care of this in modern distributions, and the package maintainers usually do enough coordination to avoid (much) breakage. But if you're trying to produce commercial shippable software (what used to be called shrinkwrap), you're not going to fit in as easily with a package management system. Your binaries will probably need updating when the shared libraries update; that's a major headache. And this is one of the reasons why there hasn't been much of a commercial market in software for Linux. Everything generally works much more smoothly if your only dependencies are glibc and a handful of other bits.
MichaelMoser123 13y ago
Of course there are exceptions: some people like to link in openssl libraries statically; that removes another attack vector - like swapping an openssl shared library with something that returns a constants for all random numbers; On the other hand that is also a bit silly; if the box is owned then all else is peanuts;
amscanne 13y ago
Interesting list! I was actually surprised that the VDSO [1] page was missing from that. For those unfamiliar... the Linux kernel selects the best system call implementation for the current system and exports a special page to user-space. It also provides a few specific additional routines (generally related to getting the current time without having to jump in and out of the kernel). I'm not advocating for this approach, but it's there and can have a big impact. As a fun exercise, I just checked how much impact this has on my VM right now... timetest.c: #include <stdio.h> #include <time.h> int main(void) { for (int i = 0; i < 1000000000; i++) { time(NULL); } } gcc timetest.c -o timetest -std=c99 && time ./timetest real 0m3.589s user 0m3.588s sys 0m0.000s gcc timetest.c -o timetest -std=c99 -static && time ./timetest real 0m41.436s user 0m16.900s sys 0m24.456s [1] http://en.wikipedia.org/wiki/VDSO http://en.wikipedia.org/wiki/VDSO

deleted 13y ago

[deleted]

There's only one minor problem; DLL hell. As long as none of your applications break when you update their shared dependencies, everything's fine. The package management system generally takes care of this in modern distributions, and the package maintainers usually do enough coordination to avoid (much) breakage. But if you're trying to produce commercial shippable software (what used to be called shrinkwrap), you're not going to fit in as easily with a package management system. Your binaries will probably need updating when the shared libraries update; that's a major headache. And this is one of the reasons why there hasn't been much of a commercial market in software for Linux. Everything generally works much more smoothly if your only dependencies are glibc and a handful of other bits.

MichaelMoser123 13y ago

Of course there are exceptions: some people like to link in openssl libraries statically; that removes another attack vector - like swapping an openssl shared library with something that returns a constants for all random numbers; On the other hand that is also a bit silly; if the box is owned then all else is peanuts;

amscanne 13y ago

Interesting list! I was actually surprised that the VDSO [1] page was missing from that. For those unfamiliar... the Linux kernel selects the best system call implementation for the current system and exports a special page to user-space. It also provides a few specific additional routines (generally related to getting the current time without having to jump in and out of the kernel). I'm not advocating for this approach, but it's there and can have a big impact. As a fun exercise, I just checked how much impact this has on my VM right now... timetest.c: #include <stdio.h> #include <time.h> int main(void) { for (int i = 0; i < 1000000000; i++) { time(NULL); } } gcc timetest.c -o timetest -std=c99 && time ./timetest real 0m3.589s user 0m3.588s sys 0m0.000s gcc timetest.c -o timetest -std=c99 -static && time ./timetest real 0m41.436s user 0m16.900s sys 0m24.456s [1] http://en.wikipedia.org/wiki/VDSO http://en.wikipedia.org/wiki/VDSO