3 ms·

> So, I think I need to stop complaining about it, and start asking the right questions of BSD users. Why is ports such a fiercely defended thing when it has so

> So, I think I need to stop complaining about it, and start asking the right questions of BSD users. Why is ports such a fiercely defended thing when it has so many weaknesses compared to modern package managers? First theres no dichotomy here. A person can use ports and pkgng. Secondly there's many nice thing about ports. If your organization has custom patches or compile options for common software, you can use the port system. Also I think a more important use of ports, is security fixes. When OpenSSL drops it's bug of the week you can patch openssl and rebuild the port tree. Then you can push the new, patched binaries into production. A sysadmin can do this all without relying on the package maintainer, ie no waiting on Redhat to push out new rpms. This can all be done in under an hour depending on the performance of the build server and automation processes in place. > Does pkgng actually solve these problems (I can't really tell, it seems to be a meta-package system that still sits atop ports)? Yes. > and building from source on a production system is silly and potentially dangerous Well of course you don't build directly on the production box. That's what a build server is for. You can use poudriere to build packages from the ports tree and then run your own package repo and have your production boxes pull from your private package repo.

SwellJoe 11y ago
"Also I think a more important use of ports, is security fixes. When OpenSSL drops it's bug of the week you can patch openssl and rebuild the port tree. Then you can push the new, patched binaries into production. A sysadmin can do this all without relying on the package maintainer, ie no waiting on Redhat to push out new rpms." I can't remember the last time I was aware of a security problem before Red Hat (and CentOS) had rolled out a fixed package. I usually know about security issues when I see a slew of update notifications from my servers (even though I'm on several security related mailing lists). Realistically, I rely on my OS vendor to provide my security fixes in a timely manner. If my systems security relied on me being able to apply patches manually in a timely manner, it would be a disaster waiting to happen. And, it is a big pile of labor I don't want on my plate. Besides, nothing stops one from installing the source package (whether RPM or deb), adding the patch, rebuilding, and pushing to your local yum or apt repository. That workflow is entirely reasonable on Linux, as well (historically easier, since maintaining a third party repo was so much easier for yum, though apt is a bit more cantankerous; it looks like FreeBSD finally supports multiple repositories and you don't need to mirror the whole ports tree just to provide a handful of custom packages, which used to be the case). ports does not provide a unique feature here, and if it is required to manually patch software in order to be reasonably quick to address security issues, that's a bug not a feature.
- 2trill2spill 11y ago
  > I can't remember the last time I was aware of a security problem before Red Hat (and CentOS) had rolled out a fixed package. I usually know about security issues when I see a slew of update notifications from my servers (even though I'm on several security related mailing lists). Well looking at the last batch of OpenSSL security advisories, CVE-2015-3197 was reported and fixed by OpenSSL two days ago. [1] Yet it looks like RedHat has yet to issue a fix. [2] > Realistically, I rely on my OS vendor to provide my security fixes in a timely manner. If my systems security relied on me being able to apply patches manually in a timely manner, it would be a disaster waiting to happen. And, it is a big pile of labor I don't want on my plate. It's not difficult to subscribe to your OS vendors security mailing list as well as the security mailing list for ALL the software you run in production. [1]: https://www.openssl.org/news/vulnerabilities.html#y2016 https://www.openssl.org/news/vulnerabilities.html#y2016 [2]: https://access.redhat.com/security/cve/cve-2015-3197 https://access.redhat.com/security/cve/cve-2015-3197
  - SwellJoe 11y ago
    So what? There is nothing unique about ports in this regard. If you want to manually patch your software, you can do it equally easily with deb/apt or rpm/yum/dnf.

SwellJoe 11y ago

"Also I think a more important use of ports, is security fixes. When OpenSSL drops it's bug of the week you can patch openssl and rebuild the port tree. Then you can push the new, patched binaries into production. A sysadmin can do this all without relying on the package maintainer, ie no waiting on Redhat to push out new rpms." I can't remember the last time I was aware of a security problem before Red Hat (and CentOS) had rolled out a fixed package. I usually know about security issues when I see a slew of update notifications from my servers (even though I'm on several security related mailing lists). Realistically, I rely on my OS vendor to provide my security fixes in a timely manner. If my systems security relied on me being able to apply patches manually in a timely manner, it would be a disaster waiting to happen. And, it is a big pile of labor I don't want on my plate. Besides, nothing stops one from installing the source package (whether RPM or deb), adding the patch, rebuilding, and pushing to your local yum or apt repository. That workflow is entirely reasonable on Linux, as well (historically easier, since maintaining a third party repo was so much easier for yum, though apt is a bit more cantankerous; it looks like FreeBSD finally supports multiple repositories and you don't need to mirror the whole ports tree just to provide a handful of custom packages, which used to be the case). ports does not provide a unique feature here, and if it is required to manually patch software in order to be reasonably quick to address security issues, that's a bug not a feature.

2trill2spill 11y ago
> I can't remember the last time I was aware of a security problem before Red Hat (and CentOS) had rolled out a fixed package. I usually know about security issues when I see a slew of update notifications from my servers (even though I'm on several security related mailing lists). Well looking at the last batch of OpenSSL security advisories, CVE-2015-3197 was reported and fixed by OpenSSL two days ago. [1] Yet it looks like RedHat has yet to issue a fix. [2] > Realistically, I rely on my OS vendor to provide my security fixes in a timely manner. If my systems security relied on me being able to apply patches manually in a timely manner, it would be a disaster waiting to happen. And, it is a big pile of labor I don't want on my plate. It's not difficult to subscribe to your OS vendors security mailing list as well as the security mailing list for ALL the software you run in production. [1]: https://www.openssl.org/news/vulnerabilities.html#y2016 https://www.openssl.org/news/vulnerabilities.html#y2016 [2]: https://access.redhat.com/security/cve/cve-2015-3197 https://access.redhat.com/security/cve/cve-2015-3197
- SwellJoe 11y ago
  So what? There is nothing unique about ports in this regard. If you want to manually patch your software, you can do it equally easily with deb/apt or rpm/yum/dnf.