Hacker News Reader

Comment by rwmj | Hacker News Reader

I read this interesting article recently about all the security problems that static linking, bundling and pinning cause for Linux distributions:

https://blogs.gentoo.org/mgorny/2021/02/19/the-modern-packag...

View on HN

Author here, and I am also a Gentoo user on my daily driver.

I read that article when it came out, and it felt disingenuous.

mgorny helps maintain Gentoo, which of all distributions, does rebuild software as necessary.

It would be a simple change to portage to rebuild all dependencies of a library when that library is updated, regardless of if the user uses static linking or not. In fact, there is a project to have a statically-linked musl-based Gentoo.

So it's possible and (I would argue) would be an easy change. mgorny would not have to worry about much because he could, in essence, treat all libraries as dynamic libraries. The only pain to be felt would be by users who would see their build times increase (to rebuild dependents).

As a user, I would happily take that tradeoff. I already build my browser, which takes 5-8 hours; I'll happily rebuild dependents of updated libraries.

> It would be a simple change to portage to rebuild all dependencies of a library when that library is updated

No change needed. It can already be done with the special ":=" dependency slot: https://devmanual.gentoo.org/general-concepts/dependencies/#...

> I already build my browser, which takes 5-8 hours; I'll happily rebuild dependents of updated libraries

This is ridiculous. I most definitely do NOT want to rebuild literally EVERY SINGLE PACKAGE on my system the moment they fix a typo in libz.

With static linking literally every other Gentoo upgrade becomes a world rebuild. See Nix. It is just insane and the main reason I don't use NixOS (without a 3rd party binary cache/host) for anything other than very small systems.

> This is ridiculous. I most definitely do NOT want to rebuild literally EVERY SINGLE PACKAGE on my system the moment they fix a typo in libz.

I understand. You don't. I do.

What my post is arguing for is not one or the other, but giving the user the choice.

I think you would be okay with making the choice of not rebuilding everything, and I would make the opposite choice.

I want to live in a world where we can both choose.

But you can already rebuild the entire world on every package change if you want (for sadomasochistic reasons? it basically makes gentoo with say KDE _unusable_); and I fail to see if there would be any practical difference on whether you statically link, you dynamically link to a hash-based soname a la nix, or you dynamically link -- you are just rebuilding everything on every library change, and you are already assuming ASLR is useless.

> It would be a simple change to portage to rebuild all dependencies of a library when that library is updated

I believe e.g. freebsd's portmaster takes a -r switch to mean "rebuild this and all its dependents" (I presume you meant revdeps here), which gets you quite a long way.

But should distributing and ensuring the security of software that users install on their own systems even be the responsibility of operating system maintainers?

Yes.

If I installed software through my OS package manager, where else would I get security updates from?!

Like on every other major OS the publisher of those applications. And I mean they should be distributing the applications as well. Not the OS publishers.

Isn't it obvious? Or do you suggest that end users should be responsible for checking and patching every package on their system? Given that Red Hat has a large department just to do that for RHEL, I can't imagine where end users would begin.

No, I’m suggesting that the authors of the applications are responsible for patching and distributing their own application like on every other major OS.

Reply on news.ycombinator.com