4 ms·

> you would count on them to fix it immediately, push out the automatic update and go on with your life. Not only do you get security updates for your distro w

> you would count on them to fix it immediately, push out the automatic update and go on with your life. Not only do you get security updates for your distro with the vast majority of Linux distros, but you also get it for all your 3rd party software, using the same system mechanism. They may not push the updates automatically, (you can of course set it that way), but some of us still want to be in control of what gets installed on our machines That's not to say it can't be improved, but the situation isn't quite as bad as you are painting it, ie there are mainstream distros that come hardened by default and security patches are regularly backported. I'd argue that macOS is also technologically less secure than modern Windows, yet its users are in no more danger than Windows users are, (despite its theoretically security), because security depends on a lot of factors including the user culture, market share etc. i.e. Linux doesn't have a culture of downloading executables from random websites for one. I'd guess most distributions feel like they're providing an adequate level of protection for their users as of now, without introducing too much friction. Once that is no longer the case, it's easy to turn on a few more knobs, the software is already there.

sytelus 10y ago
The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.
- AsyncAwait 10y ago
  > it gives a false sense of security Why is getting the latest security updates giving a false sense of security exactly? > The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on. This is where you're being unfair, the notion that the default file manager is not good enough is subjective, it is plenty good for most people. (Finder for macOS also lacks many features, yet many people never bother with alternatives). Moreover, if you do need to find a replacement, if it is in the official repos, it probably means it is popular enough to be solid. As for things like an editor,, are you telling me that Notepad is more featured than gedit?
  - wander_homer 10y ago
    > Why is getting the latest security updates giving a false sense of security exactly? Because in quite a few distributions you don't get security updates reliably. For example Debian Stable excludes most WebKit-based libraries from their update policy. https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#browser-security https://www.debian.org/releases/stable/amd64/release-notes/c... So users of browsers like Midori and Epiphany or E-Mail-Clients like Evolution on Debian Stable, currently end up using a WebKit library that hasn't been updated in more than a year. The same issue applies to Ubuntu and most of its derivatives as well. E.g. Ubuntu 14.04 users get a WebKitGTK+ library which hasn't been updated in almost a year. http://changelogs.ubuntu.com/changelogs/pool/main/w/webkitgtk/webkitgtk_2.4.10-0ubuntu0.14.04.1/changelog http://changelogs.ubuntu.com/changelogs/pool/main/w/webkitgt... Of course, the user doesn't get a warning dialog when he installs applications which rely on those outdated and insecure libraries. Ubuntu users also shouldn't rely on packages from the Universe repository (which are by far the most packages), if they care about security. Those packages are community maintained and often don't get a single update in years. In the past they didn't even update Chromium reliably.
    - m45t3r 10y ago
      This is why I think Rolling Release is the only viable model of Linux distribution in desktops. Instead of overloading a team of security experts expecting them to backport every security change to the stable version of a package, they simply follow upstream releases, build it and make sure that isn't horrible broken (however, they can't be sure that the upgrade path is seamless for every possible configuration). BTW, it is possible to check in Ubuntu which packages are supported or not: http://manpages.ubuntu.com/manpages/xenial/man1/check-support-status.1.html http://manpages.ubuntu.com/manpages/xenial/man1/check-suppor...
    - pikzen 10y ago
      You. Are. Not. Supposed. To. Install. Debian. Stable. On. A. Desktop. Machine. How many times will this have to be repeated? Stable is for servers. If you're running webkit based libraries on your server you have other issues. For desktops, both Testing and Unstable are the valid options.

sytelus 10y ago

The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.

AsyncAwait 10y ago
> it gives a false sense of security Why is getting the latest security updates giving a false sense of security exactly? > The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on. This is where you're being unfair, the notion that the default file manager is not good enough is subjective, it is plenty good for most people. (Finder for macOS also lacks many features, yet many people never bother with alternatives). Moreover, if you do need to find a replacement, if it is in the official repos, it probably means it is popular enough to be solid. As for things like an editor,, are you telling me that Notepad is more featured than gedit?
- wander_homer 10y ago
  > Why is getting the latest security updates giving a false sense of security exactly? Because in quite a few distributions you don't get security updates reliably. For example Debian Stable excludes most WebKit-based libraries from their update policy. https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#browser-security https://www.debian.org/releases/stable/amd64/release-notes/c... So users of browsers like Midori and Epiphany or E-Mail-Clients like Evolution on Debian Stable, currently end up using a WebKit library that hasn't been updated in more than a year. The same issue applies to Ubuntu and most of its derivatives as well. E.g. Ubuntu 14.04 users get a WebKitGTK+ library which hasn't been updated in almost a year. http://changelogs.ubuntu.com/changelogs/pool/main/w/webkitgtk/webkitgtk_2.4.10-0ubuntu0.14.04.1/changelog http://changelogs.ubuntu.com/changelogs/pool/main/w/webkitgt... Of course, the user doesn't get a warning dialog when he installs applications which rely on those outdated and insecure libraries. Ubuntu users also shouldn't rely on packages from the Universe repository (which are by far the most packages), if they care about security. Those packages are community maintained and often don't get a single update in years. In the past they didn't even update Chromium reliably.
  - m45t3r 10y ago
    This is why I think Rolling Release is the only viable model of Linux distribution in desktops. Instead of overloading a team of security experts expecting them to backport every security change to the stable version of a package, they simply follow upstream releases, build it and make sure that isn't horrible broken (however, they can't be sure that the upgrade path is seamless for every possible configuration). BTW, it is possible to check in Ubuntu which packages are supported or not: http://manpages.ubuntu.com/manpages/xenial/man1/check-support-status.1.html http://manpages.ubuntu.com/manpages/xenial/man1/check-suppor...
  - pikzen 10y ago
    You. Are. Not. Supposed. To. Install. Debian. Stable. On. A. Desktop. Machine. How many times will this have to be repeated? Stable is for servers. If you're running webkit based libraries on your server you have other issues. For desktops, both Testing and Unstable are the valid options.