Slashdot Mirror


Apple's Mac OS X Update Breaks Perl

mir writes "It looks like if you use CPAN to install modules, Apple's latest security update might just have broken your Perl. According to Tatsuhiko Miyagawa 'The Security Update brings (old) IO.bundle with version 1.22 but your IO.pm has been updated to the latest 1.23 on CPAN shell. (But hey, 1.23 was released in 2006...Why do you bring that ancient version back, Apple!?)'."

22 of 264 comments (clear)

  1. Fighting over the same file by Ed+Avis · · Score: 5, Insightful

    Why are Apple's updater and Perl's CPAN shell both trying to update the same file? If the file's there as part of the Apple OS then only the OS's package manager should touch it, and Perl should leave it alone (installing its own version in /usr/local if necessary). It's exactly the same on Linux distributions: the CPAN shell doesn't try to mess with the system perl which is updated using rpm or dpkg.

    --
    -- Ed Avis ed@membled.com
    1. Re:Fighting over the same file by warren.oates · · Score: 5, Informative

      We don't exactly have "package managers" in OS X. The BSD side of OS X is only barely "maintained" at all, and then in some truly obscure and incoherent bubble-headed Cupertino fashion. Anything you really want to actually work with, you have to maintain yourself: PHP, Apache, rsync, ffmpeg, Perl -- all the seriously useful stuff like that you put into /usr/local and set your $PATH accordingly. You _cannot_ trust Apple not to break things.

      --
      Doh.
    2. Re:Fighting over the same file by 99BottlesOfBeerInMyF · · Score: 5, Insightful

      We don't exactly have "package managers" in OS X.

      Sure we do, a bunch of them. That's kind of the problem.

      Anything you really want to actually work with, you have to maintain yourself

      That's a bit of an overstatement. Anything you want a cutting edge version of you'd do well to install and maintain yourself outside of Apple's update path, but for most people just using the Apple installed versions is fine.

    3. Re:Fighting over the same file by pegdhcp · · Score: 4, Informative

      Why are Apple's updater and Perl's CPAN shell both trying to update the same file?

      Probably this is the real point, as mentioned in the TFA:

      "This is another reason why you shouldn't use Perl that comes from vendors," Miyagawa says. "Apple isn't any different from Fedora on this!"

      I might add Mandriva, SuSe and most others. Distribution managers want it just run and be stable for users who do not want to know what is going on inside. If there is a need for messing with details, originally packaged software by developer is the best alternative...

    4. Re:Fighting over the same file by Alrescha · · Score: 5, Insightful

      "Why are Apple's updater and Perl's CPAN shell both trying to update the same file? If the file's there as part of the Apple OS then only the OS's package manager should touch it, and Perl should leave it alone (installing its own version in /usr/local if necessary)."

      Why must we learn these lessons again and again? Back in the beginning of time (1983), we learned the following:

      Rule #1: Never change *anything* that [vendor] sends you

      Rule #2: Always keep your stuff separate from [vendor]

      (thank you Melinda)

      --
      ...bringing you cynical quips since 1998
  2. Why does this "break" anything? by mi · · Score: 4, Insightful

    The Security Update brings (old) IO.bundle with version 1.22 but your IO.pm has been updated to the latest 1.23 on CPAN shell. (But hey, 1.23 was released in 2006...Why do you bring that ancient version back, Apple!?)'."

    The real question is (or ought to be), why is the 1-digit difference in the minor version number break things? If the 1.22 -> 1.23 change was important (as in interface-changing or something), shouldn't the new version have been named 1.3 or even 2.0?

    --
    In Soviet Washington the swamp drains you.
    1. Re:Why does this "break" anything? by Anonymous Coward · · Score: 5, Informative

      It's an XS module: They include components that are written in a language other than Perl, and have to be compiled against perl.

      Which means that if the perl binary they are pointing to changes, they break. The code itself is fine: You just need to recompile.

      Apple helpfully recompiled all the ones they shipped, so they would work. The only problem is for people who updated the modules that Apple shipped: They now have a miss-match between the Perl code that is running (that they updated) and the code that is compiled (that Apple shipped).

      Basically, you've got a library header and the library object. If the header and the object don't match exactly, you've got problems. No interface was changed, no major important pieces were changed, but now you've got 1.23 headers and a 1.22 object. Change one or the other, and everything will be fine again.

    2. Re:Why does this "break" anything? by PerlDudeXL · · Score: 5, Informative

      This is a classic problem with most *nix distribution packages and CPAN usage. This is not Apple specific.

  3. Re:Apple by telchine · · Score: 5, Funny

    Some would argue that Perl has been broken for a long time before Apple started meddling!

  4. Re: OS X and package management by 1stvamp · · Score: 4, Informative

    Or MacPorts, formerly DarwinPorts: http://macports.org/

    --
    Wes
  5. Re:Apple: Breakin' a bunch of crap recently by elrous0 · · Score: 4, Funny

    All part of Apple's plan to ensure that no one can ever use a Mac for gaming.

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
  6. Use CPAN? You deserve to lose by Jay+Maynard · · Score: 4, Informative

    CPAN is the closest thing to DLL hell on Unix systems. Modules are updated willy-nilly. No attempt is made to preserve compatibility between versions, or between modules and their dependencies. A company I used to work for had to totally abandon a large program because it was impossible to keep it working in the face of CPAN-driven upgrades, even if they did manage to get it installed the first time (by totally bypassing CPAN).

    --
    Disinfect the GNU General Public Virus!
    1. Re:Use CPAN? You deserve to lose by Anonymous Coward · · Score: 4, Informative

      Huh? The opposite is true. CPAN, if anything, is more akin to a Linux distribution's package repository.

      Would you say the same thing about, say, Debian's apt-get and friends?

      Chances are you wouldn't, but that's exactly what CPAN's like. You have to use it correctly, though, and chances are that if you had trouble with it, you weren't.

      (In particular, you should not blindly install updates all the time when there's no need, without even so much as testing them on non-production systems first. Again, consider following the trunk of any Linux distro, package-wise - would you expect things that aren't part of the distro to never break when libraries etc. are updated and new versions installed? Of course not.)

  7. Re:Apple: Breakin' a bunch of crap recently by Colonel+Korn · · Score: 5, Funny

    Right. Let's see... Quicktime still works but the Sims 2 doesn't. Quicktime doesn't seem to break anything else, so logically, it MUST be Apple's fault. I think the rest of the Quicktime users who aren't playing the Sims 2 would disagree with your placement of blame. :)

    Brainwashed much? You're basically implying that if I hit you in the head with a hammer and you're knocked out, but the hammer, nearby mailbox, and tree are unharmed, that proves that the hammer isn't to blame - your head is.

    --
    "I zero-index my hamsters" - Willtor (147206)
  8. Super bad for Servers by geekmansworld · · Score: 5, Informative

    As an XServe administrator, Apple's cryptic security updates are really starting to get on my nerves.

    You would expect that, since it is based on multiple open-source projects that are freely available, Apple would push compiled updates through Software Update to its OS X Server users. Instead, they wait so long to patch things (like Amavis or the BIND patch for Dan Kaminsky's DNS bug) that I just get frustrated and apply the patch myself. Then, when a Apple Software Update does come down the pipe, I have to consider if installing it will break my configuration and land me in hot water with my boss when he can't get his e-mail anymore.

    Apple needs to decide if they're going to regularly and consistently update the open-source software that their Server OS runs. If not, leave it alone and let the users apply and configure updates. This wishy-washy, middle-ground, Jobsy-come-lately approach is just an annoyance and an inconvenience.

    1. Re:Super bad for Servers by ducomputergeek · · Score: 5, Interesting

      I love Apple laptops and desktops. Hate Xserve and I've found OSX-Server to be nothing to write home about. When I was an Apple Certified consultant, I saw a much higher than average failure rate with Xserve hardware. It got to the point to where we'd only deploy OSX-server on PowerMac/MacPro machines. I know some people love their OSX-server tools admin package. It is a pretty slick GUI. I will give them that. But really, I can do just about anything OSX-Server can on a default OSX install. And for the price, I can build reliable servers with FreeBSD a lot cheaper with the same functionality, and arugably even more functionality than OSX-Server.

      --
      "The problem with socialism is eventually you run out of other people's money" - Thatcher.
  9. Re:Apple by Gadget_Guy · · Score: 5, Funny

    Oh, I see. I was under the impression that the phrase "It just works" was a synonym for something like "It simply works". Apparently it is a synonym for "It barely works".

    OK, that was a bit unfair. Every OS gets the occasional problem when doing updates. Assuming that there is a forthcoming fix in the near future, there is no need to obsess about it.

  10. Re: OS X and package management by TJamieson · · Score: 5, Informative

    With MacPorts you can provide a keyword before installing to see what options an install might have.

    So for instance, for apache2 you might type:
    port install apache2

    to install. Before doing this, try:
    port variants apache2

    This should produce a list. Hopefully X11 is in there (I can't verify right now). Anyway, find any options you want to enable or disable, and reform your install to look like this:
    port install apache2 +enable_option -disable_option

    This will usually let you strip away a goofy dep like X11 from programs that don't really need it.

    --
    For the last time, PIN Number and ATM Machine are redundancies!
  11. Re:Apple: Breakin' a bunch of crap recently by Tokerat · · Score: 4, Informative

    Quicktime is used on the Mac for much more than just showing a video - converting sound and image files from any format to any format (the reason my program can play AIFF, wav, MP3, AAC, etc is because Quicktime converts it to a stardard format for me). Therefore if the game is multiplatform like the Sims and all the sound effects are .wav files, Quicktime will probably be used as the standard API to convert them for playback.

    --
    CAn'T CompreHend SARcaSm?
  12. Hear Hear (for client, too)! by MisterSquid · · Score: 4, Informative

    Apple seems to have a separation between its left-brain UNIX underpinnings and its right-brain Quartz GUI.

    For example, with the last several Security Updates, which contain very little information about what all's rolled in, Apple modifies /etc/postfix/main.cf

    inet_interfaces = all

    to

    inet_interfaces = localhost.

    This effectively breaks all Internet-accessible postfix installs. Now, the question is why does Apple apply this to postfix installations explicitly enabled as Internet-accessible? I can't think of any good answer for this except as part of some other bass-ackwards security measures Apple applies in a schizophrenic attitude to the server functions of its UNIX-based client OS.

    For another example, the Aiport Extreme Base Station prior to firmware 7.3.1 had a version of DMZ host (default host in Apple bizarro-world) that worked flawlessly. In April 2007 or thereabouts, Apple rolls out firmware 7.3.1, since which default host is broken for only for BIND (UDP port 53) and all mail ports (587, 110. 995, etc) but works for WoW, BitTorrent, and all other ports. WTF?! If I set my router to designate one computer as the default/universal host, why is it still blocking certain ports that have to be opened using port mapping?

    This split-mind on UNIX vs. GUI seems to pervade Apple's mentality everywhere which is especially problematic to people like me that are not full-time developers but make extensive use of UNIX-layer services.

    Really stupid stuff, Apple. I wish you'd cut it out.

    --
    blog
  13. Re:Scripting Languages not good for most applicati by dodobh · · Score: 4, Informative

    No, this is a compiled language problem. The module is an XS module, and it has components written in C. The Perl update causes a mismatch between the library referenced by the user's compile and the system supplied one.

    Just another form of DLL hell.

    If this was a Pure Perl module, this issue would never have mattered. Scripting languages have the same problems as any compiled language when you break libraries.

    And if you are upgrading your base code in production without any form of testing, your code deserves to crash.

    --
    I can throw myself at the ground, and miss.
  14. Comparing Apple's Release Cycle to MS by aztracker1 · · Score: 4, Insightful

    That's funny... since 2000, MS has had two releases you'd have to pay to upgrade to... How many has Apple had? more than two... As for being constrained to the release cycle most new software runs in XP still... how much new Mac software runs in less than 10.3? not much.

    I actually like OSX, it has a consistent UI on a Unix core. But your arguments only show your ignorance. For the record I like different aspects of a lot of OSes. There are even parts of Vista I like (mainly the restructuring of the user paths... though would rather have an "ALL" user back, opposed to the new location for global settings. I like that Linux has a FLOSS mindset, even if the zealots can't find a balance with commercial software.

    I don' like a lot of the more politically minded decisions MS and others have taken. I find it ironic that Linux fanbois will use Samba, but ignore Mono because of patent concerns. Zealots from every corner are wrong, and spread FUD, it's what they do... the truth is generally somewhere in the middle.

    -- happy Windows, Linux, BSD & Mac User

    --
    Michael J. Ryan - tracker1.info