Comment by ajross | Hacker News Reader

Comment by ajross | Hacker News Reader

Parent Full thread

> a couple of years ago I went static only

You mean for your code, deployed on your systems. Yeah, that works fine.

Now ship a binary to a client system with your static TLS implementation, JPEG decoder, LZ decompressor, whatever. And then go hire someone to watch the CVE feeds every day to know when you have to get them to install an upgrade.

Of, if you don't want it to be your fault when they get pwned, you could just link against the system libraries and tell them to stay updated.

"Static only" makes sense for web apps developed and deployed within the same organization, for embedded solutions where the whole update/upgrade process is known to be under the control of the developer, and... basically nowhere else.

This advice is bad, sorry.

Not the parent, but I think dynamic linking with system libraries is the only time it makes good sense. Otherwise you're just asking for trouble.

The GP argues that it should be abolished everywhere, even in the cases where it makes good sense.

Of course, you need to make sure that your system actually provides up-to-date implementations of these libraries.

Still a much better bet than that you will.

Do you play any steam games or most other modern games? Yea those static compile almost everything.

This example hurts the case, it doesn't help. Windows deployment, especially of C/C++ apps, is indeed a problem. And for decades it was absolutely routine that random windows binaries turn out to be subject to attacks against libraries like zlib or libjpeg which had been long since patched in linux distributions but lived on statically in exploitable blobs.

Things have in fact gotten much better over the past years, though. Largely because developers (even of games) have moved away from this architecture and onto managed runtimes like Java and .NET where the runtime and system provide cleaner separation of dependencies and don't require the "static all the time" nonsense that was the norm since the beginning of PCs.

Reply on news.ycombinator.com