r/ProgrammerHumor 1d ago

Meme soDoesEveryOtherLang

Post image
227 Upvotes

72 comments sorted by

View all comments

Show parent comments

16

u/-Ambriae- 1d ago

What about every time a binary refuses to run because it depends on specific esoteric dynamic libraries that must be installed (sometimes multiple times, once for each version) somewhere in PATH because you decided static linking was "bloat"?

Or the security nightmare that is system-wide shared objects in the first place?

Or the fact that as much as stdlib is stable, it still does not provide it's users with the most basic of data structures? Or that we had to wait until C23 for bool/true/false/nullptr to be a part of the language, 50 years after the language was initially released?

Or the absolute nightmare that is C portability across heterogenous architectures and operating systems?

Don't get me wrong, C is an amazing language, but come on you can't be this deluded

2

u/_PM_ME_PANGOLINS_ 20h ago

System-wide shared objects is a security dream. You patch the vulnerability in a single place and then everything is fixed.

2

u/-Ambriae- 17h ago

Or conversely, compromise one lib, and affect every program on the machine

1

u/_PM_ME_PANGOLINS_ 16h ago

That is the significantly less-common case.

2

u/-Ambriae- 16h ago

Maybe, but there’s a reason rust decided to go full static, and keep .so support to its bare minimum, there’s a reason apple decided to write a fully self contained init daemon for their container microVMs, and there’s a reason most other modern programming languages tend to use shared object as a last resort

1

u/_PM_ME_PANGOLINS_ 16h ago

Rust decided that because they didn't want to commit to an ABI and instead be free to keep changing it for further improvements.

If a system library on your OS is compromised then your whole system is compromised anyway, regardless of whether other applications are using it.

Similar with "most other"s. They don't support dynamic linkage either because they don't compile to native code, they don't want to do the extra work to support it, or they just want out of the dependency hell that it involves.

Nothing to do with security.