Linux Format forums

guy · Posted: Sun Jan 01, 2012 1:20 pm Post subject: Code re-use

The other day I came across the suggestion that it it more secure to build everything into your app, rather than rely on shared libraries.

Isn't that just saying that code re-use is bad practice because it equates to vulnerability re-use? Safer to bloat the install.

Thinking of the relative security reputations of some well-known platforms and their relative tendencies for developers to depend on shared libraries, I find this a difficult idea to justify based on evidence.

If 100 instances of the same library are compiled separately into 100 apps, where is the benefit over installing once and linking from those 100 apps?

And doesn't it also depend rather heavily on the experience and professionalism of the shared library developers vs. the app developers? I'd trust a 15-year old maintenance team over a shiny new script kiddie any day.

I kind of smell subversive FUD at work - "You can trust our shiteware approach, honest. Far better than that other competitior - just read this security analysis my salesman wrote." sort of thing.
_________________
Cheers,
Guy
The eternal noob

Bazza · Posted: Sun Jan 01, 2012 2:46 pm Post subject:

Hi guy...

Sorry, but I had to vote "What are shared libraries?"...

The reason is that a very large percentage on here have no idea
what a shared library is.

What happens when a shared library becomes corrupt?
What happens when a shared library is updated?
What happens when a shared library is no-longer needed
in the latest OS incarnation?
Although not a library situation remember SNDREC32.EXE in XP
and below, but not in Vista and higher.......

You see my point.

I suspect that a library that has stood the test of time is pretty much
bullet proof AFA security is concerned. However sometimes they get
major code changes that not only affect countless apps that depend
on them but also break security and reliability.

Just a starter... ;o)
_________________
73...

Bazza, G0LCU...

Team AMIGA...

nelz · Posted: Sun Jan 01, 2012 8:47 pm Post subject: Re: Code re-use

Fat_Tuesday · Joined: Mon Oct 09, 2006 1:14 pm Posts: 77

Easy answer, only question I understood was the last one!

wyliecoyoteuk · Posted: Sun Jan 01, 2012 10:40 pm Post subject:

Shared code may mean multiple vulnerabilities, but it also means multiple eyes on it.
The old "security by obscurity" argument is why Windows has become such a pile of dudu over the years.
Anyway, every current OS uses shared libraries, and yet some are much more secure than others, so that sort of wrecks the argument, really.
_________________
The sig between the asterisks is so cool that only REALLY COOL people can even see it!

*************** ************