ISVs providing Linux downloads [LWN.net]

ISVs providing Linux downloads

Posted Sep 12, 2012 4:59 UTC (Wed) by viro (subscriber, #7872)
In reply to: ISVs providing Linux downloads by cyanit
Parent article: Meeks: Linux on the (consumer) Desktop

... along with all its bugs, that is? Guys, all software sucks. Always had, always will. Including the libraries. The rate of discovery falls as the damn thing gets less and less test exposure, but so does the rate of fixing them. Efficiency of attacker on systematic hunt for bugs does *not* diminish, though. Moreover, the less exposure does the library get, the less incentive one has to do clean fixes as opposed to minimal ones, so the codebase slides deeper and deeper into bitrot. Making further fixes more and more painful and more likely to introduce new bugs.

BTW, in case if it's non-obvious - I agree that userland approach to API stability is atrociously bad. And API design tends to be just as promiscuous and lousy.

It's just that your "solution" really isn't. Neither is bundling libraries with ISV code using those, for the same reasons.

(Log in to post comments)

ISVs providing Linux downloads

Posted Sep 12, 2012 5:39 UTC (Wed) by khim (subscriber, #9252) [Link]

Efficiency of attacker on systematic hunt for bugs does *not* diminish, though.

It goes down, too. If library just sits out there and nobody uses it then it's useless for attacker anyway. If library is actually needed by some software then user will find and install it (unless s/he'll abandon Linux, that is) and thus it'll be available for the attacker anyway. And if library is not present in the latest version of the distribution but is transplanted from older version then it'll be more buggy, not less.

It's just that your "solution" really isn't.

It's the only alternative which works. We may lament that it's bad for one reason or another (and it is!) but as long as it's the only game in town…

Neither is bundling libraries with ISV code using those, for the same reasons.

Again: if you don't provide stable ABI in your system then ISVs will bundle libraries with their offers. Acrobat brings openssl and libcurl, Firefox brings SQLite and NSS. And games bring practically everything including bundled version of SDL and libvorbis, sometimes even libjpeg and libpng.

If you think that this approach magically makes your system more secure than the one which supplies obsolete libraries in it's core then you are sorely mistaken.

As I've said: few percents of users may be satisfied with selection of goods offered in their repo. Fine, but maybe it's time to create something for the rest of us?