The modern packager’s security nightmare
Correct me if I&#x27;m wrong (really) but isn&#x27;t static linking mostly a problem for packagers? The less a package maintainer modifies the application the better IMO.<p>If application A and B rely on dependency D, which turns out to have a vulnerability, fixed in D&#x27;, Then _why_ do we think it is anyone but A &amp; B&#x27;s developers responsibility to update to D&#x27; and distribute patched versions? If the packager tries to do it, the chances of diverging A and B due to some other incompatibility are too high.<p>Either, you&#x27;re running well maintained software (OSS or commercial), and get the update in a timely manner, or you&#x27;re running unmaintained software and don&#x27;t get the update.<p>Only in the second case does it make sense to patch in a dynamically linked dependency. And I&#x27;m sure there&#x27;s plenty of examples of this, but the real issue is running un-maintained software!<p>I am much happier keeping in close sync with timely releases from Go&#x2F;Rust projects than I am with Debian et. al&#x27;s style of freezing the world.