Don't you know? Dynamic linking is always better for security. This is a great example. With dynamic linking you can more quickly patch security holes caused by dynamic linking.
If everything were statically linked, getting your daily security update would basically involve redownloading the entire distribution, since when a core component were patched everything would have to be rebuilt. This wouldn't be practical. Therefore, dynamic linking is the norm on binary distributions.
Debian really hates code duplication and prefers risking security issues resulting from trying to reduce code duplication. This is not the first time this sort of thing has happened, and has caused security issues.
Comments
Why did Debian need to change Redis to link Lua dynamically in the first place?
Don't you know? Dynamic linking is always better for security. This is a great example. With dynamic linking you can more quickly patch security holes caused by dynamic linking.
Always seems a bit strong given Debian’s policy of dynamic linking is responsible for this security vulnerability.
You missed the second part of the message that makes it clear it's sarcasm :)
Dynamic linking is Debian's preferred approach. When it works as intended (which is usually), it's generally a good thing.
If everything were statically linked, getting your daily security update would basically involve redownloading the entire distribution, since when a core component were patched everything would have to be rebuilt. This wouldn't be practical. Therefore, dynamic linking is the norm on binary distributions.
Debian really hates code duplication and prefers risking security issues resulting from trying to reduce code duplication. This is not the first time this sort of thing has happened, and has caused security issues.
Unnecessary static linking is a Policy violation.