Those shared libraries are a way to create plugins for commercial software.
Surely one can use OS IPC instead, like we used to do during the days static linking ruled the compiler world, but then don't complain about higher resource usage when every single plugin is its own process.
It used to be the case that resource limitations meant that shared libraries were meaningfully more efficient. I know that some software communities like to complain about modern software bloat but statically linking everything is so incredibly valuable across so many different dimensions that it is absolutely worth the cost. Heck, modern link-time optimization probably means that applications run faster despite the code-size bloat.
Shared libraries not only require this absolutely crippling adherence to the ABI they also are a security mess since you need updates from both your software provider and your operating system vendor to ensure that anything is safe.
If you can't recompile your application then you are already fucked for security regardless of static or dynamic linking.
And even for vulns in libraries, to me, recompiling and shipping an update is a more trustworthy approach than just hoping that my users are getting library updates from their OS vendors.
Yes but they often aren't and you have no control over whether a user will update their dynamic libraries. And you still need to be able to recompile and redistribute your application because you are going to have vulns in your code as well so this hasn't actually saved you the responsibility of recompiling to protect your users.
Those shared libraries are a way to create plugins for commercial software.
That is an entirely reasonable use. And one that can have specific types and ABI guarantees for the commercial software and the plug-in. In addition, this would only be required if you were the developer of the commercial software or a plug-in. One example of this is COM which had specific types and memory allocation/deallocation.
However, the case where the C standard library is being dynamically linked, forces everyone to pay the price for ABI stability.
Comments
Those shared libraries are a way to create plugins for commercial software.
Surely one can use OS IPC instead, like we used to do during the days static linking ruled the compiler world, but then don't complain about higher resource usage when every single plugin is its own process.
It used to be the case that resource limitations meant that shared libraries were meaningfully more efficient. I know that some software communities like to complain about modern software bloat but statically linking everything is so incredibly valuable across so many different dimensions that it is absolutely worth the cost. Heck, modern link-time optimization probably means that applications run faster despite the code-size bloat.
Shared libraries not only require this absolutely crippling adherence to the ABI they also are a security mess since you need updates from both your software provider and your operating system vendor to ensure that anything is safe.
Static linking is even worse in what concerns security unless you can compile the world from scratch, every single time a new update comes out.
If you can't recompile your application then you are already fucked for security regardless of static or dynamic linking.
And even for vulns in libraries, to me, recompiling and shipping an update is a more trustworthy approach than just hoping that my users are getting library updates from their OS vendors.
Dynamic libraries can be updated independently of the main application, that is the whole point about plugins, and commercial software is a thing.
Yes but they often aren't and you have no control over whether a user will update their dynamic libraries. And you still need to be able to recompile and redistribute your application because you are going to have vulns in your code as well so this hasn't actually saved you the responsibility of recompiling to protect your users.
That is an entirely reasonable use. And one that can have specific types and ABI guarantees for the commercial software and the plug-in. In addition, this would only be required if you were the developer of the commercial software or a plug-in. One example of this is COM which had specific types and memory allocation/deallocation.
However, the case where the C standard library is being dynamically linked, forces everyone to pay the price for ABI stability.
Except that the C standard library is compiler specific, only in the UNIX world it blends with the OS API, due to their symbiotic relationship.