Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> And more, downstreams tend not to use the whole package anyway. So you end up importing a "small" 2000-line crate just to use 7% of it.

Does that really matter? The compiler only includes the stuff you actually use anyways.



> The compiler only includes the stuff you actually use anyways.

Goodness, no. The compiler can elide unreferenced symbols, that's not at all the same thing as "stuff you actually use". Just build a static glibc binary someday around "int main(void) { return 0; }" for a reference as to just how much stuff can get sucked in even if you think you aren't using it.

In fact "unexpectedly included feature" was part of the xz-utils attack last year! The backdoor leveraged the fact that the openssh daemon linked against libsystemd for authentication, which links against liblzma (for some reason, I don't know why), despite xz not being required for anything in the ssh protocol. Boom.

And in that case, the two dependencies (systemd and xz-utils) were inarguably in the "complicated" category that apps can't be expected to reimplment. Think how much more complicated this gets if every bit of junk logic becomes a "dependency".

People need to be thinking about this as a problem!


Thanks. Definitely have to read more into this.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: