Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 14 Mar 2020 18:32:37 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: Advocating musl to the chromium OS developers

On Sat, Mar 14, 2020 at 05:02:42PM +0100, Brian Peregrine wrote:
> I started a thread at the Chromium OS google groups (called Chromium
> OS: compile using musl as default ):
> https://groups.google.com/a/chromium.org/forum/#!topic/chromium-os-dev/iiDRh42EmvE
> 
> I think that it would benefit the Chromium OS, but they need to be
> convinced more and want more proof (see reply by Kevin). I pointed
> them to the musl vs glibc comparison table
> (http://www.etalabs.net/compare_libcs.html ) but Mike said:
> 
> "the bloat comparison on the musl site is largely irrelevant to us.
> it's interesting to embedded people, and to people making comparison
> charts, but we could not care less about things like "Smallest static
> C program" or "Static hello (using printf)".  we don't use static
> programs, nor will we ever have any program *not* using a large set of
> C library functionality.  plus, as Julius points out, the performance
> comparison on that site already shows that glibc is generally better
> than musl.

Indeed in many ways I find the comparison done way back then detracts
from the real benefits of musl that most users will see by focusing on
things that are nice side effects of having a good implementation, but
not the most important in themselves. Of course (1) I think they're
wrong that most programs use nearly all of libc, or at least 500-900k
worth, and (2) whether static or dynamic linking, small size does buy
you a lot in terms of cache.

But the more important things are the much smaller bug surface
(especially by not having a lazy dynamic link resolver), not getting
in situations where libc has to abort because it can't make forward
progress (e.g. glibc's pthread_cancel with dynamic loading libgcc_s.so
or lazy dynamic TLS allocation), self-containedness and ability to
have real static binaries, dns resolver that handles errors in ways
that don't let (possibly intentional) network outages or creation of
new TLDs change results, etc.

> The idea why it would be important  to get them switched to musl is
> because Google is behind Chromium OS and they also develop the
> Chromium web browser (and the Chromium browser is in Chromium too I
> believe). So, if Chromium OS changes to musl, they'll need to provide
> far better support for musl in chromium browser too. Also, having
> google developers help out on musl support in the other programs used
> by Chromium OS is always a big benefit too.
> 
> So, if anyone has any good arguments, go ahead and post them at the
> google groups thread (you however do need a google account to post).

While I would welcome Google using musl if they like to, through my
past experiences I've increasingly gotten the impression that they
don't want to be using anything they can't control. The goal seems to
be not quality but rather to not have to answer to the community at
large and to a maintainer who can say no (which many would say is a
maintainer's most important job).

They used musl once for Fuchsia, and after I spent an inordinate
amount of free labor clarifying some pedantic copyright concerns they
had with contributors we'd lost touch with, rather than continuing any
relationship with upstream musl they just forked it and made a lot of
gratuitous changes to introduce C++ that looked likely to break things
(I don't recall with sufficient detail to say for sure that they did,
but my impression was that they did).

Since then they've launched their own libc under the LLVM banner, and
while they've repeatedly tried to paint it as a public/community
project, they keep slipping and revealing that the requirements are
all defined by Google. In any case it looks like they've made almost
no progress on actually implementing it, because -- surprise! --
making a viable libc is actually kinda hard.

I'd welcome a turnaround on all this, and recognize that companies are
not coherent persons but reflections of changing groups of people and
business goals operating within them, but it remains to be seen
if/when something like that might actually happen. Regardless of
whether Google uses musl, what I'd like to see most is getting them on
board with the idea of long term (like, over many decades) stable
platforms built on standards rather than constant disruption by
whoever's the biggest today.

Rich

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.