Re: Security lessons from liblzma - libsystemd

Поиск
Список
Период
Сортировка
От Magnus Hagander
Тема Re: Security lessons from liblzma - libsystemd
Дата
Msg-id CABUevEz1dk4Cpd+a8UJ5q+TaSOM=JOXg57h2ya5zqOukPmXJGg@mail.gmail.com
обсуждение исходный текст
Ответ на Re: Security lessons from liblzma - libsystemd  (Peter Eisentraut <peter@eisentraut.org>)
Список pgsql-hackers
On Thu, Apr 4, 2024 at 1:10 AM Peter Eisentraut <peter@eisentraut.org> wrote:
On 03.04.24 23:19, Magnus Hagander wrote:
> When the code is this simple, we should definitely consider carrying it
> ourselves. At least if we don't expect to need *other* functionality
> from the same library in the future, which I doubt we will from libsystemd.

Well, I've long had it on my list to do some integration to log directly
to the journal, so you can preserve metadata better.  I'm not sure right
now whether this would use libsystemd, but it's not like there is
absolutely no other systemd-related functionality that could be added.

Ah interesting. I hadn't thought of that use-case.


 
Personally, I think this proposed change is trying to close a barndoor
after a horse has bolted.  There are many more interesting and scary
libraries in the dependency tree of "postgres", so just picking off one
right now doesn't really accomplish anything.  The next release of
libsystemd will drop all the compression libraries as hard dependencies,
so the issue in that sense is gone anyway.  Also, fun fact: liblzma is
also a dependency via libxml2.


To be clear, I didn't mean to single out this one, just saying that it's something we should keep in consideration in general when adding library dependencies. Every new dependency, no matter how small, increases the management and risks for it. And we should just be aware of that and weigh them against each other.

As in we should *consider* it, that doesn't' mean we should necessarily *do* it.

(And yes, there are many scary dependencies down the tree)

--

В списке pgsql-hackers по дате отправления:

Предыдущее
От: Magnus Hagander
Дата:
Сообщение: Re: Add notes to pg_combinebackup docs
Следующее
От: Alexander Korotkov
Дата:
Сообщение: Re: post-freeze damage control