Hacker Newsnew | past | comments | ask | show | jobs | submitlogin



There's only one minor problem; DLL hell. As long as none of your applications break when you update their shared dependencies, everything's fine. The package management system generally takes care of this in modern distributions, and the package maintainers usually do enough coordination to avoid (much) breakage.

But if you're trying to produce commercial shippable software (what used to be called shrinkwrap), you're not going to fit in as easily with a package management system. Your binaries will probably need updating when the shared libraries update; that's a major headache. And this is one of the reasons why there hasn't been much of a commercial market in software for Linux. Everything generally works much more smoothly if your only dependencies are glibc and a handful of other bits.


Interesting list!

I was actually surprised that the VDSO [1] page was missing from that. For those unfamiliar... the Linux kernel selects the best system call implementation for the current system and exports a special page to user-space. It also provides a few specific additional routines (generally related to getting the current time without having to jump in and out of the kernel).

I'm not advocating for this approach, but it's there and can have a big impact. As a fun exercise, I just checked how much impact this has on my VM right now...

timetest.c:

    #include <stdio.h>
    #include <time.h>

    int main(void) {
        for (int i = 0; i < 1000000000; i++) {
            time(NULL);
        }
    }
gcc timetest.c -o timetest -std=c99 && time ./timetest

    real	0m3.589s
    user	0m3.588s
    sys 	0m0.000s
gcc timetest.c -o timetest -std=c99 -static && time ./timetest

    real	0m41.436s
    user	0m16.900s
    sys 	0m24.456s
[1] http://en.wikipedia.org/wiki/VDSO


Of course there are exceptions: some people like to link in openssl libraries statically; that removes another attack vector - like swapping an openssl shared library with something that returns a constants for all random numbers;

On the other hand that is also a bit silly; if the box is owned then all else is peanuts;




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: