Dynamic linking
Say we have program X with dependency Y. X+Y is either dynamic or static. X can either have responsive maintainers or unresponsive maintainers. Y can either change to fix a bug or change to add a bug. (With Heartbleed, I remember our server was fine because we were on some ancient version of OpenSSL.)
Here are the scenarios:<p>- dynamic responsive remove bug: Positive&#x2F;neutral. Team X would have done it anyway.<p>- dynamic unresponsive remove bug: Positive.<p>- dynamic responsive add bug: Negative. Team X will see the bug but only be able to passively warn users not to use Y version whatever.<p>- dynamic unresponsive add bug: Negative. Users will be impacted and have to get Y to fix the error.<p>- static responsive remove bug: Positive&#x2F;neutral: Team X will incorporate the change from Y, although possibly somewhat slower (but safer).<p>- static unresponsive remove bug: Negative. Users will have to fork X or goad them into incorportating the fix.<p>- static responsive add bug: Positive. Users will not get the bad version of Y.<p>- static unresponsive add bug: Positive. Users will not get the bad version of Y.<p>Overall, dynamic is positive 1, neutral 1, negative 2, and static is positive 2, neutral 1, negative 1. Unless you can rule out Y adding bugs, static makes more sense. Dynamic is best if &quot;unresponsive remove bug&quot; is likely, but if X is unresponsive, maybe you should just leave X anyway.