4 ms·
When Heartbleed hit, to fix your dynamically linked system, you replaced openssl and called it a day. With your statically linked system, you replace every sin
by snarfy 11y ago
When Heartbleed hit, to fix your dynamically linked system, you replaced openssl and called it a day.
With your statically linked system, you replace every single binary on your system that linked to openssl during build (if you can figure that out).
- shanemhansen 11y agoWith heartbleed I ran apt-get update && apt-get upgrade. With static linking I do the same. (I don't consider forcing the Debian build farm to rebuild dependencies an insurmountable challenge).
- quotemstr 11y agoAnd all the programs you compiled from source or got from other parties? Rebuilding the world on a whim is fantasy.
- shanemhansen 11y agoI disagree. Rebuilding the world on a whim is devops.
- overgard 11y agoThe security argument goes both ways though. Lets say I update my music player and through some complicated chain it ends up also updating my system libc and openssl, and lets say one of those libraries accidentally introduced a vulnerability. If those libraries were statically linked, it's just my music player that's in trouble. With dynamic linking, instead of my music player having a security issue (not a big deal, probably), my entire system is now vulnerable including my web browser, even though I didn't update my web browser. (much bigger deal) If you consider biological ecosystems, diverse genetics are almost always more robust against infection. You could potentially make that analogy about the ecosystem of computers as well.
- Sanddancer 11y agoIn your situation, static building would also result in rebuilding libc and openssl, and from there your web browser, as most package management systems, and package managers, would make sure that the updated libc were relinked in to as many programs as possible as soon as they were available.