Every once in a while some people from the Linux community debate the
issue of shared
libraries. The discussion is usually pretty heated and never gets
resolved, but just quiets down a bit only to resurface a couple of
months later.
The debate is often related to the way that we distribute software.
While some of the static-link-the-world crowd is all about minimalism,
another part of the community commonly argues based on the premise that
shared libraries are annoying for app developers to deal with. The also
implicitly make the assumption that it is the developer’s responsibility
to package their software (which it is not) and that a closer
relationship between app developers and users is would be a good thing
and that distro maintainers just get in the way.
While I do not feel qualified to comment on all the technical aspects
regarding static versus dynamic linking, I want to contribute an
argument regarding who is in control of a system. Independent of
technical considerations this debate has an impact on the power dynamic
between users and developers.
Since I changed my mind about this issue some time ago, and because I want to
show both sides of the argument, let me start off by explaining
why software management through a distribution’s package repositories
might be seen unfavorably.
The distribution maintainer as an intermediary in software delivery
between the app developer and the end user has at least three disadvantages
compared to a more direct developer-user interaction:
Delayed updates. Packaging software in each distro’s repo causes
delays between developers publishing an update and the user receiving
it. This might just mean that users have to wait longer until they
can get their hands on the hot new feature, but it can also have
security implications as weaknesses remain unfixed on user systems
longer.
Single point of failure. Package maintainers can turn evil, their
accounts can get compromised, the package repo can get
compromised… This can all happen to app developers as well, but a
central repo is a higher value target for attackers.
Increased technological complexity. Technical provisions for building
and running the software have to be made. This two-stage process can
increase the overall complexity, so that either developers or
distro maintainers have to do more work.
In some form or the other these are the arguments that are usually
presented to show how centralized software repositories are flawed.
So, whatever the reasons for distro-managed packaging systems might have
been in the past, surely this does not make sense anymore.
Instead, developers want a direct relationship with their users without
the interference of an intermediary that introduces delays and
complexity. Developers seem to want users to download the executable
software directly from their website and then run it without interacting
with a package management system. (Or even worse:, they want their users
to grab the software from a programming language-specific package
manager to get the worst of both worlds.)
Updates are pushed directly to users, preferably via
auto-update
mechanisms that every application then has to include.
Developers try to convince users that this is the only way to get the latest
security fixes and the hottest new features ASAP, while running updates
through a distro’s pipeline introduces friction for the reasons
mentioned above.
These seem like reasonable arguments at first glance, so why don’t they
convince me anymore? Why is a package-based software distribution system
in fact better for end-users?
Delayed updates. The delays between developers publishing an update
and the user receiving it leave time for some bugs to be detected.
This allows distro maintainers to withhold an update that contains a
known issue, while an automatic update would have immediately
installed a potentially broken version.
Additional review. It just takes one evil or compromised
application to get a user in trouble. Trusting hundreds of developers
by obtaining the software directly from them is a greater risk then
trusting distro maintainers to review applications and keep malicious
ones out of their repos. Sure, maintainers can not rigorously audit
every package they build, but more eyes can find more issues. And
since you kind of have to trust your distro maintainers
anyway, I consider getting software from other channels to be less secure.
Separation of concerns. Dealing with distro-specific configuration
and installation does introduce complexity, but it also distributes
that complexity between app developers and distro maintainers. This
can in theory allow developers to care less about differences between
distributions because distro maintainers can customize the software to
fit their distro.
Distro maintainers are in a better position to know what their users
want. They typically have an interest in offering a somewhat consistent
system and they know how to properly integrate applications into that
system. Application developers on the other hand have no way of knowing
some of the specifics of their users’ setups; they can only resort to
one-size-fits-all solutions that usually do not fit anyone particularly
well.
As a user I want to choose from a large catalogue of software and
receive the latest security updates in timely manner. But what I want
even more, is a stable, lean and consistent system. And generally
speaking I feel like these interests are more aligned with those of distro
maintainers.
App developers’ idas of how certain things should work can be at odds
with what users actually want. Only when disto maintainers manage the
package repositories and only when that is the default way for users to obtain
software, can the distro act as a strong stakeholder in the greater
ecosystem. And a multilateral approach to developing, distributing and
customizing software seems to me to guarantee greater stability.
From the world of non-free software we know how harmful an unbalanced
division of power can be: End-users in non-free software ecosystems are
at the mercy of developers and don’t have a say in what
software to run and how. The world of free software on the other hand
fundamentally enables users and puts them in charge of their system.
Free software should not replicate the imbalance of power between
the producers and consumers of software that we already see in non-free
ecosystems.