4 ms·

Seems like Debian is getting more aggressive on EOL'ing specific packages' security support, and/or upgrading to new upstream releases in the stable distro, lat

by 0x0 11y ago

Seems like Debian is getting more aggressive on EOL'ing specific packages' security support, and/or upgrading to new upstream releases in the stable distro, lately. There's been version bumps on mysql, php, openjdk and I think virtualbox. At least we're getting security support(1), but it's a little concerning that more and more upstream vendors seem to leave long-term distros in the dust :-/ Is this a new development? I can't remember similar EOL announcements even just a year ago. Although better to actually announce this than letting packages linger unattended/unannounced... (1) except php security support in wheezy is also already EOL'ed, before the usual wheezy EOL.

derefr 11y ago
I feel like Debian has maybe finally cottoned onto the idea that it only really makes sense to do "transparently apply security upgrades"-style LTS support for packages that are actual OS infrastructure, because people are increasingly vendoring/containerizing anything that affects whether their app works. In other words (presuming containerization): Debian LTS is the thing you install a Docker daemon onto and then forget about. But Debian LTS is obviously not for use as a container base-image (container-images don't auto-upgrade; and they can be QAed on each app release to ensure the app works with ABI changes of deps.) Given those two facts, LTS support these days really only has to apply to things that will be run as part of the (from a developer's perspective) black-box abstraction that is "the OS", rather than considered a part of the "service and its dependencies" slug which gets versioned and deployed by the service-owner.
- amyjess 11y ago
  > I feel like Debian has maybe finally cottoned onto the idea that it only really makes sense to do "transparently apply security upgrades"-style LTS support for packages that are actual OS infrastructure, because people are increasingly vendoring/containerizing anything that affects whether their app works. Or, for that matter, since Elasticsearch is written in Java, most Java developers just use Maven to pull in dependencies and don't even bother using the OS package manager.
  - mkhpalm 11y ago
    I don't think the vast majority of us know how to.
- skarap 11y ago
  Except - everyone will consider the docker package from Debian LTS too old for any "real" use and will prefer to do `curl ...|bash` dance to install docker, and it will be happy to include statically linked/bundled dependencies. The modern Linux distribution (the one everybody wants to use) is something which has curl and bash, and can execute ELF binaries.
- vacri 11y ago
  While Docker (and containers) are on fire at the moment, they're not the only game in town.
- chei0aiV 11y ago
  I hope you don't forget about doing security updates to Debian LTS installs. Also, LTS probably has Linux kernels that are far too old.
tetha 11y ago
Hm, I think that the lifetime of the LTS of debian or centos are just too long for some projects, and I can only partly blame the projects. Backporting fixes into a 5 or 10 year old version of the software isn't fun. Or, for example you could not port to python 3 fully and drop python 2 if you wanted to support centos 7 easily. It's messy, but I'd rather support removing the packages and probably even languages or python packages from the distros repos so you're geared towards effort immediately, instead of installing elasticsearch and then ending up vulnerable.
- vbernat 11y ago
  Elasticsearch 1.0.0 was released less than 2 years ago. A project with more than 100 M$ of funding may be able to maintain stable branches for users who cannot cope with the non-trivial upgrades to more recent versions.
- vacri 11y ago
  People want LTS systems - it's why LTS has become a thing in recent years. It's not Debian and Centos forcing it on the community, it's the community asking for it.

by 0x0 11y ago

derefr 11y ago

I feel like Debian has maybe finally cottoned onto the idea that it only really makes sense to do "transparently apply security upgrades"-style LTS support for packages that are actual OS infrastructure, because people are increasingly vendoring/containerizing anything that affects whether their app works. In other words (presuming containerization): Debian LTS is the thing you install a Docker daemon onto and then forget about. But Debian LTS is obviously not for use as a container base-image (container-images don't auto-upgrade; and they can be QAed on each app release to ensure the app works with ABI changes of deps.) Given those two facts, LTS support these days really only has to apply to things that will be run as part of the (from a developer's perspective) black-box abstraction that is "the OS", rather than considered a part of the "service and its dependencies" slug which gets versioned and deployed by the service-owner.

amyjess 11y ago
> I feel like Debian has maybe finally cottoned onto the idea that it only really makes sense to do "transparently apply security upgrades"-style LTS support for packages that are actual OS infrastructure, because people are increasingly vendoring/containerizing anything that affects whether their app works. Or, for that matter, since Elasticsearch is written in Java, most Java developers just use Maven to pull in dependencies and don't even bother using the OS package manager.
- mkhpalm 11y ago
  I don't think the vast majority of us know how to.
skarap 11y ago
Except - everyone will consider the docker package from Debian LTS too old for any "real" use and will prefer to do `curl ...|bash` dance to install docker, and it will be happy to include statically linked/bundled dependencies. The modern Linux distribution (the one everybody wants to use) is something which has curl and bash, and can execute ELF binaries.
vacri 11y ago
While Docker (and containers) are on fire at the moment, they're not the only game in town.
chei0aiV 11y ago
I hope you don't forget about doing security updates to Debian LTS installs. Also, LTS probably has Linux kernels that are far too old.

tetha 11y ago

Hm, I think that the lifetime of the LTS of debian or centos are just too long for some projects, and I can only partly blame the projects. Backporting fixes into a 5 or 10 year old version of the software isn't fun. Or, for example you could not port to python 3 fully and drop python 2 if you wanted to support centos 7 easily. It's messy, but I'd rather support removing the packages and probably even languages or python packages from the distros repos so you're geared towards effort immediately, instead of installing elasticsearch and then ending up vulnerable.

vbernat 11y ago
Elasticsearch 1.0.0 was released less than 2 years ago. A project with more than 100 M$ of funding may be able to maintain stable branches for users who cannot cope with the non-trivial upgrades to more recent versions.
vacri 11y ago
People want LTS systems - it's why LTS has become a thing in recent years. It's not Debian and Centos forcing it on the community, it's the community asking for it.