Hacker News Reader

Comment by mfuzzey | Hacker News Reader

I haven't seen such problems on Debian or Ubuntu guess it's par for the course with a bleeding edge distro.

The author seems to be focusing on the disk space advantage and claiming it's not enough to justify the downsides today. I can understand that but I don't think disk space savings are the main advantage of shared dependencies, rather it's centralized security updates. If every package bundles libfoo what happens there's a security vulnerability in libfoo?

View on HN

> If every package bundles libfoo what happens there's a security vulnerability in libfoo?

That’s actually the key point that many people in this discussion seem to miss.

What happens is that libfoo gets fixed, possibly by the maintainers of the distro, and all the apps using it are good to go again.

With multiple versions bundled to multiple apps, a good number of those apps will never be updated, at least not in a timely manner, and the computer will be left vulnerable.

Then you get an alert that your libfoo has a vulnerability (GitHub does a pretty good job here!) and you roll out a new version with a patched libfoo.

As a user, I don't want to assume that every single maintainer of every single app that uses (a statically linked) libfoo is keeping up to date with security issues in their dependencies and has the time and ability to promptly update their software.

But I feel pretty safe believing that the debian libfoo package maintainer is on top of things and will quickly release an update to libfoo.so that all apps running on my system will be able to take advantage of.

That's fair, but the Debian maintainer could just as well update libfoo.a and kick off builds of all the reverse transitive dependencies of libfoo.a.

Specifically in the case of Debian, who is going to pay for all the additional infrastructure (build servers) that switching to dependency vendoring/static linking would require?

Good question. I think someone would have to run the numbers here!

Reply on news.ycombinator.com