From owner-freebsd-hackers  Thu Dec  4 17:36:12 1997
Return-Path: <owner-freebsd-hackers>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id RAA24221
          for hackers-outgoing; Thu, 4 Dec 1997 17:36:12 -0800 (PST)
          (envelope-from owner-freebsd-hackers)
Received: from whistle.com (s205m131.whistle.com [207.76.205.131])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id RAA24216
          for <freebsd-hackers@FreeBSD.ORG>; Thu, 4 Dec 1997 17:36:10 -0800 (PST)
          (envelope-from archie@whistle.com)
Received: (from smap@localhost) by whistle.com (8.7.5/8.6.12) id RAA27287; Thu, 4 Dec 1997 17:35:40 -0800 (PST)
Received: from bubba.whistle.com(207.76.205.7) by whistle.com via smap (V1.3)
	id sma027283; Thu Dec  4 17:35:32 1997
Received: (from archie@localhost) by bubba.whistle.com (8.8.5/8.6.12) id RAA11453; Thu, 4 Dec 1997 17:35:32 -0800 (PST)
From: Archie Cobbs <archie@whistle.com>
Message-Id: <199712050135.RAA11453@bubba.whistle.com>
Subject: Re: libmd.so ?
In-Reply-To: <199712050039.QAA20293@bubba.whistle.com> from Archie Cobbs at "Dec 4, 97 04:39:35 pm"
To: archie@whistle.com (Archie Cobbs)
Date: Thu, 4 Dec 1997 17:35:31 -0800 (PST)
Cc: freebsd-hackers@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL31 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-hackers@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk


Archie Cobbs writes:
> I noticed that in 2.2.5, /usr/lib/libmd.a exists but no (a.out) shared
> version of the same exists... how come? The cvs log messages are
> not very informative. I assume this is some kind of optimization...

Ah, now after having looked again I see the relevant comment..

  revision 1.1.1.1
  date: 1994/07/24 03:29:55;  author: phk;  state: Exp;  lines: +0 -0

  Reviewed by:    phk
  Imported libmd.  This library contains MD2, MD4 and MD5.
  These three boggers pop up all over the place all of the time, so I 
  decided we needed a library with them.  In general they are used for
  security checks, so if you use them you want to link them static.

<nitpicking>

Isn't it the job of the particular program being compiled to
determine whether security warrants linking this statically?
There are plenty of non-security related reasons to use MD5
(for example, as a checksummer).

Not installing the shared lib at all seems a bit presumptuous,
though understandable from a security conscious point of view.

</nitpicking>

-Archie

___________________________________________________________________________
Archie Cobbs   *   Whistle Communications, Inc.  *   http://www.whistle.com