5 ms·

I'll take an "insecure" ldd over having to recompile every single binary when there is a glibc/libjpeg/libpng/libwhatever security fix, any day. I'm sure the l

by 0x0 11y ago

I'll take an "insecure" ldd over having to recompile every single binary when there is a glibc/libjpeg/libpng/libwhatever security fix, any day. I'm sure the ldd problem could be solved by writing a slightly smarter "ldd" that doesn't actually execute the ELF binary, as well.

quotemstr 11y ago
Try readelf -d. $ readelf -d ~/edev/trunk/src/emacs | grep NEEDED 0x0000000000000001 (NEEDED) Shared library: [libpthread.so.0] 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x0000000000000001 (NEEDED) Shared library: [libtiff.so.5] 0x0000000000000001 (NEEDED) Shared library: [libjpeg.so.8] 0x0000000000000001 (NEEDED) Shared library: [libpng12.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgif.so.4] 0x0000000000000001 (NEEDED) Shared library: [libXpm.so.4] 0x0000000000000001 (NEEDED) Shared library: [libgtk-3.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgdk-3.so.0] 0x0000000000000001 (NEEDED) Shared library: [libpango-1.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libcairo.so.2] 0x0000000000000001 (NEEDED) Shared library: [libgdk_pixbuf-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgio-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgobject-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libglib-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libSM.so.6] 0x0000000000000001 (NEEDED) Shared library: [libICE.so.6] 0x0000000000000001 (NEEDED) Shared library: [libX11.so.6] 0x0000000000000001 (NEEDED) Shared library: [libXrender.so.1] 0x0000000000000001 (NEEDED) Shared library: [libXft.so.2] 0x0000000000000001 (NEEDED) Shared library: [libasound.so.2] 0x0000000000000001 (NEEDED) Shared library: [librsvg-2.so.2] 0x0000000000000001 (NEEDED) Shared library: [libm.so.6] 0x0000000000000001 (NEEDED) Shared library: [libacl.so.1] 0x0000000000000001 (NEEDED) Shared library: [librt.so.1] 0x0000000000000001 (NEEDED) Shared library: [libdbus-1.so.3] 0x0000000000000001 (NEEDED) Shared library: [libXfixes.so.3] 0x0000000000000001 (NEEDED) Shared library: [libxml2.so.2] 0x0000000000000001 (NEEDED) Shared library: [libgpm.so.2] 0x0000000000000001 (NEEDED) Shared library: [libtinfo.so.5] 0x0000000000000001 (NEEDED) Shared library: [libgconf-2.so.4] 0x0000000000000001 (NEEDED) Shared library: [libselinux.so.1] 0x0000000000000001 (NEEDED) Shared library: [libfreetype.so.6] 0x0000000000000001 (NEEDED) Shared library: [libfontconfig.so.1] 0x0000000000000001 (NEEDED) Shared library: [libz.so.1] 0x0000000000000001 (NEEDED) Shared library: [libotf.so.0] 0x0000000000000001 (NEEDED) Shared library: [libm17n-core.so.0] 0x0000000000000001 (NEEDED) Shared library: [libm17n-flt.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgnutls-deb0.so.28]
sdijf8sdhf 11y ago
Dynamic linking ends up being a wash or a net negative for # of recompiles when you consider that developers of important dynamic libraries break binary compatibility all the time on non-security-related changes.
- quotemstr 11y ago
  > developers of important dynamic libraries like glibc break binary compatibility all the time on non-security-related changes. You couldn't have picked a worse example. glibc goes to great lengths to maintain backward compatibility. glibc is practically the reason ELF symbol versions exist. https://www.redhat.com/f/summitfiles/presentation/June2/Developer%20Tools/Drepper_Writing%20Shared%20Libraries.pdf https://www.redhat.com/f/summitfiles/presentation/June2/Deve...
  - sdijf8sdhf 11y ago
    Guess I was wrong about glibc, so I removed that from the comment. I seem to remember fairly frequent full system updates, with it as the center, when I used Linux, but it might have been another library at fault.
  - heavenlyhash 11y ago
    And yet in practice, the number of steam games on linux that I can't run because the developers compiled them against a newer version of libc than I have is in the dozens.
    - quotemstr 11y ago
      Compatibility works the other way around. You can run binaries compiled against an older libc on a newer glibc, but there's no reason to expect that binaries compiled against a newer libc should be able to run against older versions of libc. If you demand that, you demand software stasis.
      - sdijf8sdhf 11y ago
ori_b 11y ago
> I'll take an "insecure" ldd over having to recompile every single binary when there is a glibc/libjpeg/libpng/libwhatever security fix, any day. With the "independent packaging" push using containers and dependency bundling, you get both downsides for the cost of one. https://blogs.gnome.org/alexl/2015/02/17/first-fully-sandboxed-linux-desktop-app/ https://blogs.gnome.org/alexl/2015/02/17/first-fully-sandbox...

by 0x0 11y ago

quotemstr 11y ago

Try readelf -d. $ readelf -d ~/edev/trunk/src/emacs | grep NEEDED 0x0000000000000001 (NEEDED) Shared library: [libpthread.so.0] 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x0000000000000001 (NEEDED) Shared library: [libtiff.so.5] 0x0000000000000001 (NEEDED) Shared library: [libjpeg.so.8] 0x0000000000000001 (NEEDED) Shared library: [libpng12.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgif.so.4] 0x0000000000000001 (NEEDED) Shared library: [libXpm.so.4] 0x0000000000000001 (NEEDED) Shared library: [libgtk-3.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgdk-3.so.0] 0x0000000000000001 (NEEDED) Shared library: [libpango-1.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libcairo.so.2] 0x0000000000000001 (NEEDED) Shared library: [libgdk_pixbuf-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgio-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgobject-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libglib-2.0.so.0] 0x0000000000000001 (NEEDED) Shared library: [libSM.so.6] 0x0000000000000001 (NEEDED) Shared library: [libICE.so.6] 0x0000000000000001 (NEEDED) Shared library: [libX11.so.6] 0x0000000000000001 (NEEDED) Shared library: [libXrender.so.1] 0x0000000000000001 (NEEDED) Shared library: [libXft.so.2] 0x0000000000000001 (NEEDED) Shared library: [libasound.so.2] 0x0000000000000001 (NEEDED) Shared library: [librsvg-2.so.2] 0x0000000000000001 (NEEDED) Shared library: [libm.so.6] 0x0000000000000001 (NEEDED) Shared library: [libacl.so.1] 0x0000000000000001 (NEEDED) Shared library: [librt.so.1] 0x0000000000000001 (NEEDED) Shared library: [libdbus-1.so.3] 0x0000000000000001 (NEEDED) Shared library: [libXfixes.so.3] 0x0000000000000001 (NEEDED) Shared library: [libxml2.so.2] 0x0000000000000001 (NEEDED) Shared library: [libgpm.so.2] 0x0000000000000001 (NEEDED) Shared library: [libtinfo.so.5] 0x0000000000000001 (NEEDED) Shared library: [libgconf-2.so.4] 0x0000000000000001 (NEEDED) Shared library: [libselinux.so.1] 0x0000000000000001 (NEEDED) Shared library: [libfreetype.so.6] 0x0000000000000001 (NEEDED) Shared library: [libfontconfig.so.1] 0x0000000000000001 (NEEDED) Shared library: [libz.so.1] 0x0000000000000001 (NEEDED) Shared library: [libotf.so.0] 0x0000000000000001 (NEEDED) Shared library: [libm17n-core.so.0] 0x0000000000000001 (NEEDED) Shared library: [libm17n-flt.so.0] 0x0000000000000001 (NEEDED) Shared library: [libgnutls-deb0.so.28]

sdijf8sdhf 11y ago

Dynamic linking ends up being a wash or a net negative for # of recompiles when you consider that developers of important dynamic libraries break binary compatibility all the time on non-security-related changes.

quotemstr 11y ago
> developers of important dynamic libraries like glibc break binary compatibility all the time on non-security-related changes. You couldn't have picked a worse example. glibc goes to great lengths to maintain backward compatibility. glibc is practically the reason ELF symbol versions exist. https://www.redhat.com/f/summitfiles/presentation/June2/Developer%20Tools/Drepper_Writing%20Shared%20Libraries.pdf https://www.redhat.com/f/summitfiles/presentation/June2/Deve...
- sdijf8sdhf 11y ago
  Guess I was wrong about glibc, so I removed that from the comment. I seem to remember fairly frequent full system updates, with it as the center, when I used Linux, but it might have been another library at fault.
- heavenlyhash 11y ago
  And yet in practice, the number of steam games on linux that I can't run because the developers compiled them against a newer version of libc than I have is in the dozens.
  - quotemstr 11y ago
    Compatibility works the other way around. You can run binaries compiled against an older libc on a newer glibc, but there's no reason to expect that binaries compiled against a newer libc should be able to run against older versions of libc. If you demand that, you demand software stasis.
    - sdijf8sdhf 11y ago

ori_b 11y ago

> I'll take an "insecure" ldd over having to recompile every single binary when there is a glibc/libjpeg/libpng/libwhatever security fix, any day. With the "independent packaging" push using containers and dependency bundling, you get both downsides for the cost of one. https://blogs.gnome.org/alexl/2015/02/17/first-fully-sandboxed-linux-desktop-app/ https://blogs.gnome.org/alexl/2015/02/17/first-fully-sandbox...