3 ms·

Shared libraries are a fantastic idea. Static linking wastes system resources and makes system-wide library updates problematic. Docker's approach to things i

Shared libraries are a fantastic idea. Static linking wastes system resources and makes system-wide library updates problematic. Docker's approach to things is essentially a higher level form of static linking, which is to say that it's not a very good approach. It's papering over the package management problem. We need general-purpose package management systems that allow for different applications to use different versions of shared libraries without interference. Luckily, the Nix and GNU Guix projects solve this problem very well, if only they could get some more "mindshare."

e40 11y ago
Yeah, having to rebuild every app that uses OpenSSL when a new advisory is issued... wow, that would be expensive!
- adricnet 11y ago
  Thousands of mobile app developers feel this pain now, from that particular library. Not updating these applications is not acceptable to most organizations / device operators. Just in case anyone thought the parent was sarcasm or theory, some refs: http://www.digitaltrends.com/mobile/heartbleed-bug-apps-affected-list/ http://www.digitaltrends.com/mobile/heartbleed-bug-apps-affe... http://blog.trendmicro.com/trendlabs-security-intelligence/bundled-openssl-library-also-makes-apps-and-android-411-vulnerable-to-heartbleed/ http://blog.trendmicro.com/trendlabs-security-intelligence/b...
digi_owl 11y ago
There is also Gobolinux, that do so in a less stringent fashion. This in that, as i understand it, compiling a lib with a feature enabled or disabled will produce different tree branches in NixOS/Guix, while Gobolinux will happily replace one compile with another if it is of the same lib version number. So you can't have lib foo 1.0 with feature X enabled in one compile sitting side by side with the same foo 1.0 with feature X disabled when using Gobolinux. Then again, Gobolinux has never been meant as a server distro... Edit: thinking about it, Gobolinux could perhaps be extended with checksum dirs inside the version-subdir to separate different compiles. Not sure if this has been considered or attempted.

e40 11y ago

Yeah, having to rebuild every app that uses OpenSSL when a new advisory is issued... wow, that would be expensive!

adricnet 11y ago
Thousands of mobile app developers feel this pain now, from that particular library. Not updating these applications is not acceptable to most organizations / device operators. Just in case anyone thought the parent was sarcasm or theory, some refs: http://www.digitaltrends.com/mobile/heartbleed-bug-apps-affected-list/ http://www.digitaltrends.com/mobile/heartbleed-bug-apps-affe... http://blog.trendmicro.com/trendlabs-security-intelligence/bundled-openssl-library-also-makes-apps-and-android-411-vulnerable-to-heartbleed/ http://blog.trendmicro.com/trendlabs-security-intelligence/b...

digi_owl 11y ago

There is also Gobolinux, that do so in a less stringent fashion. This in that, as i understand it, compiling a lib with a feature enabled or disabled will produce different tree branches in NixOS/Guix, while Gobolinux will happily replace one compile with another if it is of the same lib version number. So you can't have lib foo 1.0 with feature X enabled in one compile sitting side by side with the same foo 1.0 with feature X disabled when using Gobolinux. Then again, Gobolinux has never been meant as a server distro... Edit: thinking about it, Gobolinux could perhaps be extended with checksum dirs inside the version-subdir to separate different compiles. Not sure if this has been considered or attempted.