3 ms·

I don't quite understand why people are upset with this. This is common in every, single Linux distro. Some vulnerabilities are simply not worth patching. Debia

by m4r71n 10y ago

I don't quite understand why people are upset with this. This is common in every, single Linux distro. Some vulnerabilities are simply not worth patching. Debian also has quite a few unpatched issues: https://security-tracker.debian.org/tracker/status/unreported https://security-tracker.debian.org/tracker/status/unreporte... And CentOS doesn't even publish that data because it would probably terrify you... The fact is that not all vulnerabilities are equal. Some silly crashing bug in Wireshark cannot be equated to an easily-exploitable RCE in some widely used library. I am pretty sure most of the latter are fixed everywhere, whereas the former should be ignored. If your use case really really requires fixing such low importance issues, then patch it yourself, or pay support fees to someone who will do it for you. And the fact that Debian patches some issues but Ubuntu does not is simply a question of how much work has been put into it. If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. Ubuntu, I assume, must go through a much more grueling process to get fixes out. Use whichever fits your use case...

nitrogen 10y ago
Maybe Wireshark isn't the best example, since it's a tool one tends to use to identify potentially malicious traffic in the first place.
- m4r71n 10y ago
  Exactly! So why would you ever consider this to be a safe application, with or without the vulnerabilities? Wireshark should be used in a closed environment (VM) as should all tools that handle potentially malicious data.
cwyers 10y ago
Given the claim "Ubuntu has a number of vulnerabilities that are patched in Debian," I am unsure of how "Debian has unpatched vulnerabilities too" is supposed to make me feel better, given that Debian is an upstream of Ubuntu and so presumably those are ALSO unpatched in Ubuntu.
- rlpb 10y ago
  Debian is an upstream of Ubuntu only in the development release. Ubuntu stable releases are effectively branches (like the stable releases of every other distro). Stable release maintenance of Debian and Ubuntu are thus independent in principle. In practice patches for one are likely to be similar to what is needed on the other, issues affecting one are likely to affect the other, there are Debian developers who are also Ubuntu developers, Canonical employees who are also Debian developers, everyone is working towards a common goal of stable maintenance, and so forth, so there is quite a bit of communication and cross-pollination between the two. For example: I'm a Canonical employee and Debian maintainer; today I've spent quite a bit of time working on a security fix for a package I maintain in Debian that I'm effectively being paid to do by Canonical.
finishingmove 10y ago
Distros like Manjaro have been on the receiving end of criticism regarding security updates, but how worse is it really compared to the more mainstream distros? I, as a layman, see no difference.
- 0x6c6f6c 10y ago
  Didn't Manjaro suggest rolling your system date back because their certificate were out of date? Sometimes it's not what went wrong, it's your approach to fixing it.
  - finishingmove 10y ago
    Well, no excuse for something like that. That's bad. I'm wondering generally though, after it reached some maturity (let's say 2016+ Manjaro), what's the difference in security of that distro compared to something like Debian? Is a distro like Arch more secure than any other? And do you need to be a Linux guru to be "safe" as a desktop user? Or does it really not matter that much at all to the casual user? Again, I'm a layman, genuinely interested in this topic. As you might have inferred, I've recently switched from Debian to Manjaro, and Debian was my first "home" Linux.
    - m4r71n 10y ago
      I think it's about what tools you use day to day. If, for example, you have SSH installed on your machine but don't have sshd enabled, then you could care less how outdated it is. Nobody is exploiting you through it if it's not running. If all you use your workstation for is browsing and text editing, then it's safe to assume you want those two applications to be as secure as possible. You can then look at, for example, what browser version the distro of your choice ships and judge it from that. Firefox, as an example, releases quite often and a distro that doesn't keep up with those updates gets a minus point from me. This is my personal view at things and may not sit with everyone.
ownagefool 10y ago
> If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. That seems like an unfair statement. Debian is a stable distro and I'd say has a pretty good track record of doing what it does. It seems disingenuous to suggest they're patching willy nilly.
- m4r71n 10y ago
  I did not mean to belittle the efforts of package maintainers, most of which are people who don't get paid for it and do it out of their own volition (which I applaud!). They definitely put hours upon hours into improving the software that is shipped in Debian (or any other community distro for that matter). But you cannot argue that the efforts of a single maintainer compare to the effort of a dedicated engineering team, QA team, and a release engineering team of an enterprise company (Ubuntu, Suse, Red Hat), whose only job is to assure that every single bug is patched correctly.
  - ownagefool 10y ago
    Well of course, but debian isn't developed by a single maintainer, there's about 260 active maintainers and I believe well over 1000 contributors per year. Either way, I don't think we should compare either on anything other than what they produce. You're free to think Ubuntu providers a better distro but please base it on something that isn't meta such as number of paid employees, because that does a disservice to those who give up their free time.

by m4r71n 10y ago

nitrogen 10y ago

Maybe Wireshark isn't the best example, since it's a tool one tends to use to identify potentially malicious traffic in the first place.

m4r71n 10y ago
Exactly! So why would you ever consider this to be a safe application, with or without the vulnerabilities? Wireshark should be used in a closed environment (VM) as should all tools that handle potentially malicious data.

cwyers 10y ago

Given the claim "Ubuntu has a number of vulnerabilities that are patched in Debian," I am unsure of how "Debian has unpatched vulnerabilities too" is supposed to make me feel better, given that Debian is an upstream of Ubuntu and so presumably those are ALSO unpatched in Ubuntu.

rlpb 10y ago
Debian is an upstream of Ubuntu only in the development release. Ubuntu stable releases are effectively branches (like the stable releases of every other distro). Stable release maintenance of Debian and Ubuntu are thus independent in principle. In practice patches for one are likely to be similar to what is needed on the other, issues affecting one are likely to affect the other, there are Debian developers who are also Ubuntu developers, Canonical employees who are also Debian developers, everyone is working towards a common goal of stable maintenance, and so forth, so there is quite a bit of communication and cross-pollination between the two. For example: I'm a Canonical employee and Debian maintainer; today I've spent quite a bit of time working on a security fix for a package I maintain in Debian that I'm effectively being paid to do by Canonical.

finishingmove 10y ago

Distros like Manjaro have been on the receiving end of criticism regarding security updates, but how worse is it really compared to the more mainstream distros? I, as a layman, see no difference.

0x6c6f6c 10y ago
Didn't Manjaro suggest rolling your system date back because their certificate were out of date? Sometimes it's not what went wrong, it's your approach to fixing it.
- finishingmove 10y ago
  Well, no excuse for something like that. That's bad. I'm wondering generally though, after it reached some maturity (let's say 2016+ Manjaro), what's the difference in security of that distro compared to something like Debian? Is a distro like Arch more secure than any other? And do you need to be a Linux guru to be "safe" as a desktop user? Or does it really not matter that much at all to the casual user? Again, I'm a layman, genuinely interested in this topic. As you might have inferred, I've recently switched from Debian to Manjaro, and Debian was my first "home" Linux.
  - m4r71n 10y ago
    I think it's about what tools you use day to day. If, for example, you have SSH installed on your machine but don't have sshd enabled, then you could care less how outdated it is. Nobody is exploiting you through it if it's not running. If all you use your workstation for is browsing and text editing, then it's safe to assume you want those two applications to be as secure as possible. You can then look at, for example, what browser version the distro of your choice ships and judge it from that. Firefox, as an example, releases quite often and a distro that doesn't keep up with those updates gets a minus point from me. This is my personal view at things and may not sit with everyone.

ownagefool 10y ago

> If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. That seems like an unfair statement. Debian is a stable distro and I'd say has a pretty good track record of doing what it does. It seems disingenuous to suggest they're patching willy nilly.

m4r71n 10y ago
I did not mean to belittle the efforts of package maintainers, most of which are people who don't get paid for it and do it out of their own volition (which I applaud!). They definitely put hours upon hours into improving the software that is shipped in Debian (or any other community distro for that matter). But you cannot argue that the efforts of a single maintainer compare to the effort of a dedicated engineering team, QA team, and a release engineering team of an enterprise company (Ubuntu, Suse, Red Hat), whose only job is to assure that every single bug is patched correctly.
- ownagefool 10y ago
  Well of course, but debian isn't developed by a single maintainer, there's about 260 active maintainers and I believe well over 1000 contributors per year. Either way, I don't think we should compare either on anything other than what they produce. You're free to think Ubuntu providers a better distro but please base it on something that isn't meta such as number of paid employees, because that does a disservice to those who give up their free time.