If you can't recompile your application then you are already fucked for security regardless of static or dynamic linking.
And even for vulns in libraries, to me, recompiling and shipping an update is a more trustworthy approach than just hoping that my users are getting library updates from their OS vendors.
Yes but they often aren't and you have no control over whether a user will update their dynamic libraries. And you still need to be able to recompile and redistribute your application because you are going to have vulns in your code as well so this hasn't actually saved you the responsibility of recompiling to protect your users.
Comments
If you can't recompile your application then you are already fucked for security regardless of static or dynamic linking.
And even for vulns in libraries, to me, recompiling and shipping an update is a more trustworthy approach than just hoping that my users are getting library updates from their OS vendors.
Dynamic libraries can be updated independently of the main application, that is the whole point about plugins, and commercial software is a thing.
Yes but they often aren't and you have no control over whether a user will update their dynamic libraries. And you still need to be able to recompile and redistribute your application because you are going to have vulns in your code as well so this hasn't actually saved you the responsibility of recompiling to protect your users.