<story><title>Rust in illumos</title><url>https://wegmueller.it/blog/posts/2024-09-02-rust-on-illumos</url></story><parent_chain><item><author>Scramblejams</author><text>&amp;gt; I really really enjoy how I can ship a thing with exactly a certain set of versions&lt;p&gt;Just curious, how do you handle security monitoring and updates when doing this?&lt;p&gt;I&amp;#x27;ve been exposed to two major approaches:&lt;p&gt;At $FAANG we&amp;#x27;re on a treadmill where company CI force builds your stuff every time anything in your requirements.txt releases a new version (semver respected, at least) because in the absence of targeted CVE monitoring (which itself won&amp;#x27;t cover you 100%), that&amp;#x27;s the only practical way they see to keep up with security updates. If a dependency change breaks your project and you leave it broken for too long, peeps above you start getting autocut tickets. This leads to a lot of ongoing maintenance work for the life of the project because eventually you get forced into newer minor and eventually major versions whether you like it or not.&lt;p&gt;Outside of $FAANG I&amp;#x27;ve gotten a whole lot of mileage building customer software on top of Debian- or Ubuntu-packaged dependencies. This allows me to rely on the distro for security updates without the churn, and I&amp;#x27;m only forced to take newer dependencies when the distro version goes EOL. Obviously this constrains my library selection a lot, but if you can do it there&amp;#x27;s very little maintenance work compared to the other approach.&lt;p&gt;I&amp;#x27;d like to hear how others handle this because both approaches obviously have considerable downsides.</text></item><item><author>rtpg</author><text>This article really comes at some of the crux of packaging pains for many languages. The &amp;quot;distro ships the software&amp;quot; idea is something so many modern language toolkits are pretty far away from (and, as someone constantly burned by Debian packaging choices, something I&amp;#x27;m pretty happy with as well). But without a good answer, there&amp;#x27;s going to be frustration.&lt;p&gt;When distros are charging themselves with things like security, shared libraries do become a bit load bearing. And for users, the idea that you update some lib once instead of &amp;quot;number of software vendor&amp;quot; times is tempting! But as a software developer, I really really enjoy how I can ship a thing with exactly a certain set of versions, so it&amp;#x27;s almost an anti-feature to have a distro swap out functionality out from under me.&lt;p&gt;Of course there can be balances and degrees to this. But a part of me feels like the general trend of software packaging is leaning towards &amp;quot;you bundle one thing at a time&amp;quot;, away from &amp;quot;you have a system running N things&amp;quot;, and in that model I don&amp;#x27;t know where distro packagers are (at least for server software).</text></item></parent_chain><comment><author>jeroenhd</author><text>Don&amp;#x27;t forget the third option: don&amp;#x27;t. Updates are necessary when the customer asks for them. Most customers won&amp;#x27;t, and if they do, they don&amp;#x27;t know they need an update if you compile everything statically.&lt;p&gt;Personally, the update story is why I find developing on Windows much easier than developing on Linux. Instead of hundreds of small, independent packages, you can just target the _massive_ Windows API. You can take the &amp;quot;living off the land&amp;quot; approach on Linux too, but it&amp;#x27;s harder, often relying on magical IOCTLs and magical file paths rather than library function calls.&lt;p&gt;Not that I think the Win32&amp;#x2F;WinRT API is particularly well-designed, but at least the API is there, guaranteed to be available, and only breaks in extremely rare circumstances.</text></comment>
<story><title>Rust in illumos</title><url>https://wegmueller.it/blog/posts/2024-09-02-rust-on-illumos</url></story><parent_chain><item><author>Scramblejams</author><text>&amp;gt; I really really enjoy how I can ship a thing with exactly a certain set of versions&lt;p&gt;Just curious, how do you handle security monitoring and updates when doing this?&lt;p&gt;I&amp;#x27;ve been exposed to two major approaches:&lt;p&gt;At $FAANG we&amp;#x27;re on a treadmill where company CI force builds your stuff every time anything in your requirements.txt releases a new version (semver respected, at least) because in the absence of targeted CVE monitoring (which itself won&amp;#x27;t cover you 100%), that&amp;#x27;s the only practical way they see to keep up with security updates. If a dependency change breaks your project and you leave it broken for too long, peeps above you start getting autocut tickets. This leads to a lot of ongoing maintenance work for the life of the project because eventually you get forced into newer minor and eventually major versions whether you like it or not.&lt;p&gt;Outside of $FAANG I&amp;#x27;ve gotten a whole lot of mileage building customer software on top of Debian- or Ubuntu-packaged dependencies. This allows me to rely on the distro for security updates without the churn, and I&amp;#x27;m only forced to take newer dependencies when the distro version goes EOL. Obviously this constrains my library selection a lot, but if you can do it there&amp;#x27;s very little maintenance work compared to the other approach.&lt;p&gt;I&amp;#x27;d like to hear how others handle this because both approaches obviously have considerable downsides.</text></item><item><author>rtpg</author><text>This article really comes at some of the crux of packaging pains for many languages. The &amp;quot;distro ships the software&amp;quot; idea is something so many modern language toolkits are pretty far away from (and, as someone constantly burned by Debian packaging choices, something I&amp;#x27;m pretty happy with as well). But without a good answer, there&amp;#x27;s going to be frustration.&lt;p&gt;When distros are charging themselves with things like security, shared libraries do become a bit load bearing. And for users, the idea that you update some lib once instead of &amp;quot;number of software vendor&amp;quot; times is tempting! But as a software developer, I really really enjoy how I can ship a thing with exactly a certain set of versions, so it&amp;#x27;s almost an anti-feature to have a distro swap out functionality out from under me.&lt;p&gt;Of course there can be balances and degrees to this. But a part of me feels like the general trend of software packaging is leaning towards &amp;quot;you bundle one thing at a time&amp;quot;, away from &amp;quot;you have a system running N things&amp;quot;, and in that model I don&amp;#x27;t know where distro packagers are (at least for server software).</text></item></parent_chain><comment><author>jjnoakes</author><text>I strive for the latter approach as much as possible. I&amp;#x27;m happy doing more work as a developer (like using a slightly older version of libraries or languages) to ensure that I build on a stable base that gets security updates without tons of major version api churn.</text></comment>