Hacker News Reader

Comment by orra | Hacker News Reader

> I don't really buy that dynamic linking all the things is such a boon to security.

Agreed. It's really not a panacea. When you upgrade a library, you probably want to restart the running applications that depend upon this. Dynamic linking won't save you.

The solution is having a graph of your dependencies! IIRC, NixOS gets this right. I don't think Debian's apt did?

View on HN

> When you upgrade a library, you probably want to restart the running applications that depend upon this. Dynamic linking won't save you.

That's an orthogonal issue. You need to restart affected services nevertheless, whether it was linked statically or bundled in nix.

I wish people stopped repeating this red herring restart argument against dynamic linking every time the topic is brought up.

I would really like to know how NixOS solves this problem for things like yarn, webpack, parcel, esbuild, npm, pip, conda, cargo, stack, go modules, ruby gems, etc.

Usually there are tools to extract the necessary dependency information (url and hash) from a package manager's lockfile and produce a fixed-output derivation so a Nix expression can reproduce the build environment. I know of yarn2nix, cargo2nix, and node2nix, and I wrote and maintain gradle2nix for JVM projects.

It's doesn't really, and that's the problem. There are automated tools and scripts to help, but there are always edge cases so that you end up going back to using pip for example.

Nix and language package managers just don't really play well together.

There are scripts and daemons that help you determine what needs restarting[1,2]. NixOS installs can go in separate directory prefixes when there are conflicts. For Gentoo and other Linux distributions, maintainers usually won't mark something stable without resolving conflicts, and this usually means sticking to older stable version of libraries until newer versions of libraries are fully supported by all installed packages. This can definitely be more work for maintainers, and as the blog posts says, it's a sisyphean task.

[1] https://manpages.debian.org/buster/debian-goodies/checkresta...

[2] https://github.com/liske/needrestart

Thanks, checkrestart looks useful. I wasn't aware of it.

Given that it's in a goodies package though, I assume it's not integrated with apt—at least by default.

I'm thinking of that apt prompt that says "There are services installed on your system which need to be restarted when certain libraries, such as libpam, libc, and libssl, are upgraded." I presume then that uses a hardcoded list of important services.

I can't help with checkrestart or apt questions, but if I can plug 'needrestart -r a': it restarts services, messages outdated shells/user logins and checks for newer kernels/microcode. It will also tell you if any interpreters/containers need restarting, but YMMV here. It's never blown up for me even when restarting boot services, and should work on any distro as far as I can tell. I use it on Gentoo.

Apt has a graph of dependencies and anti-dependencies. They’ve been getting this right since the late 90s.

Reply on news.ycombinator.com