Static linking pitfalls, harms and challenges
summary
Examines problems that widespread static linking (including vendoring/packing/uber-jars) creates for Debian release and security management — for example difficulty tracking vulnerable code, rebuild burdens, and limitations of workarounds like Static-Built-Using fields, binNMU, or mass rebuilds. Describes security concerns related to trusting compiled artefacts (a Thompson-style ‘trusting trust’ angle), the role and limits of reproducible builds, and proposes ideas such as weak dynamic linking and leaf static linking as possible mitigations.
AI-written summary · about
related talks
35mWhat C++ developers should know about globals (and the linker)
10mEvil Twins and the Secret Lives of Linkers!
35mThe Dependency Mirage: Hidden Vulnerabilities in Your Compiled Binaries
58mDependency Management at the End of the Rainbow
40mReproducible Builds: Unexpected Benefits and Problems
37mLessons Learned Applying Compiletime Hardening Options for Security-Critical Program Binary in Linux
05mDependency Demons
30mHow Secure Is Your Build/Server?