Subject: Statically linked beta 18?

From: Amal Phadke <[email-masked]>
Date: Mon, 6 Jul 1998 10:13:43 -1000 (HST)

Hi all

	I just compiled and installed beta 18 on my MkLinux box. I noticed
that unlike the previous betas on Linux platform, beta 18 ftpd binary is
now statically linked. Is there any security related concern that prompted
this change? 

I removed the -static flag from the src/makefiles/Makefile.lnx and
recompiled it as a dynamically linked binary. Should I be worried?

Thanks.
---
Amal Phadke
Department of Ocean Engineering
University of Hawaii at Manoa

e-mail: [email-masked] (MkLinux DR3 alpha5)

---

From: Dan Stromberg <[email-masked]>
Date: Mon, 06 Jul 1998 13:53:40 -0700

No, you've done a good thing.

Some (confused) people think that dynamic binaries are a security
problem.  In truth, the reverse is true, because of the added (and often
neglected) maintenance burden of static binaries.

EG, sun just found a bunch of security holes in their "nsl" library.  If
you'd statically linked a bunch of security programs against it, you'd
now have to relink all of them, and more than that, you'd have to KNOW
to relink all of them (and many people won't bother, or won't know, or
won't remember how many apps they statically linked, and you can't just
ldd or odump to find out).

If the programs are dynamically linked, you just patch the library and
you're done.

---

From: Amal Phadke <[email-masked]>
Date: Mon, 6 Jul 1998 17:39:13 -1000 (HST)

> If the programs are dynamically linked, you just patch the library and

Well, that's quite true. However, since beta 18 Linux makefile had static
linking as the default, I wonder if from now on that's going to be the
case. Perhaps, if wu-ftpd authors can be persuaded to use autoconf, it
would be possible to select static or dynamic linking and many other
options and generate appropriate makefiles. That would be more elegant. 

---
Amal Phadke

---

From: [email-masked] (Stan Barber)
Date: 7 Jul 1998 05:59:07 GMT

>options and generate appropriate makefiles. That would be more elegant. 

There will be an autoconfiguration mechanism in the first release of the
wu-ftpd daemon after the 2.4.2 release. See the web pages at academ for
more information on this:
	http://www.academ.com/academ/wu-ftpd/index.html

The Linux static change was suggested by Stephen Costaras <[email-masked]>.
Perhaps you could ask him directly why he suggested it.
-- 
Stan   | PGP Key ID: 55CB6421              | Opinions expressed are only mine.
Olan   | Phone: +1-713-793-0222            | Email: [email-masked]
Barber | Fax:   +1-713-793-0221            | http://www.academ.com/~sob