Static linking considered harmful

[Andrew Haley]

Alan Cox writes:
 > On Wed, Nov 22, 2006 at 11:32:09PM -0800, Ulrich Drepper wrote:
 > > Why?  This makes no sense.  You have to provide arguments for each .a 
 > > file.  As I said, you cannot even build a graphical application without 
 > 
 > Why do you have to provide arguments for each .a file ?
 > 
 > > libdl.  And all server apps are security relevant and should never use 
 > > static linking for anything which doesn't come with the package.
 > 
 > And if the user happens to disagree with you... ?

The core problem is this: more and more, the implementors of crucial
system libraries are assuming that the users will not use static
linkage.  (There is a bunch of good reasons for this, as Uli
explained.)  However, many application writers still use static
linkage, and these application writers either don't know or don't care
that various random things are going to fail if they continue to link
statically.

So, we need somehow to communicate to the application writers that
they need to stop linking statically.  One rather brutal way to do
this is simply not to provide static libraries.  That would suit me.
However, I can understand that no matter how much explanation we do,
some people will continue to want static libraries.  For them, your
separate RPM solution makes sense.  The fact that they have had to
download a separate static library means they can't say that they
weren't warned.

Andrew.