Re: Limited security support for Go/Rust? Re ssh3
On Mon, Jan 15, 2024 at 10:17:17AM +0100, Bastian Blank wrote:
> On Sun, Jan 14, 2024 at 04:24:57PM +0100, Simon Josefsson wrote:
> > Isn't that what the text refers to? Vendoring and static linking are
> > two examples of the same problem that the security team may encounter.
>
> We accept vendoring of autoconf/automake/gnulib distro wide.
We _did_ accept that in the past, but these days you get smacked with a RC
bug for not building from source.
> Please show practical problems with it?
* not working on new archs (most of the work of making sure autoconfage gets
rebuilt was done by arm64 porters when it was a new thing)
* not being able to fix bugs in autoconfage
* failing to adapt to changes in the toolchain
> The vendoring of gnulib, well, is old and maybe you could
> show that it is a problem in the sources that have it, aka they don't
> handle security fixes and at the same time don't change the library.
Gnulib has not been useful for ages, thus packages still shipping vendored
copies are harmless -- functions that gnulib was meant to provide
implementation for were missing on ancient unices like HP-UX or SCO that
are long dead by now. A glance at recent commits in gnulib shows a lot of
retrocomputing names: Windows, OS/2, MacOS 10.5, AIX, on hardware of that
level of recency. It's not used for new ports: the most recent reference
to riscv in commit messages is from _2018_.
Thus, I say the problem with vendored libraries is mostly unrelated to
that of static linking, and thus they don't need to share a solution.
> Here the problem is embedded into the language oekosystem itself. It is
> not a choice of the software author to do static linking.
It's mostly an issue with the deployment scheme at Google: I heard they
recompile all their software and reinstall it on their fleet EVERY WEEK.
This is about the only case where non-special-case (/sbin/ldconfig etc)
static linking works.
Then they shared their internal project with the world (good) without caring
how it affects others (bad). Unlike them, we can't rebuild the world every
time a bug is fixed (security or not).
Meow!
--
⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ 'Russkiy voyennyi korabl, idi nakhuy'
⢿⡄⠘⠷⠚⠋⠀
⠈⠳⣄⠀⠀⠀⠀
Reply to: