Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by nwah1 | Hacker News Reader

Parent Full thread

nwah1·

Why don't more distros use the lighter weight C runtimes?

View on HN

For example, Node.js still has test case failures when running on musl on Alpine Linux:

https://github.com/nodejs/docker-iojs/issues/44#issuecomment...

Most apps will work out of the box, but you can see in that issue 1+ year of various people debugging and fixing issues to just get existing test cases to pass.

Many applications don't work with anything but glibc, so distributions don't use them; because distributions don't use them, applications don't support anything but glibc.

The number of applications that rely on malloc/free being multithreaded fork safe, like glibc's allocator, is astounding. Off the top of my head, any application that uses glib and g_spawn_* is quite unportable for this reason.

Most of them aren't audited at all.

If you switched SSL library from OpenSSL after Heartbleed, odds are you went from bad to worse.

lighter weight doesn't mean fewer bugs.

Why would that matter? This was a bug in a POSIX function that all C libraries would be required to implement.

And the C libraries all implement those functions (mostly) differently. The "lighter weight" standard libraries tend to have simpler implementations of these functions, which may be easier to audit for these kinds of bugs.

For example:

https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/pos...

compare with

http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...

Your musl libc list is too short. GNU libc puts much of getaddrinfo() into one source file. musl libc splits it across several, including:

* http://git.musl-libc.org/cgit/musl/tree/src/network/getaddri...

* http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_s...

* http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_n...

* http://git.musl-libc.org/cgit/musl/tree/src/network/lookup_i...

* http://git.musl-libc.org/cgit/musl/tree/src/network/resolvco...

See also the BSD libc implementation of getaddrinfo():

* https://svnweb.freebsd.org/base/stable/10/lib/libc/net/getad...

* http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/net/getaddr...

Reply on news.ycombinator.com