6 ms·

The way MySQL was being handled as a hybrid of open-source and closed-source for tests was causing a lot of trouble for organizations like Debian that wanted to

The way MySQL was being handled as a hybrid of open-source and closed-source for tests was causing a lot of trouble for organizations like Debian that wanted to ship truly open-source software. MariaDB was, at the time, a pretty close fork with the right license model so it was a good drop-in substitute. These situations are rare, but it's not without precedent.

ocdtrekkie 9y ago
To be clear: I have no issue with Debian shipping MariaDB. I have an issue with Debian pretending MariaDB is MySQL. If I run "apt-get install mysql-server" and get something other than MySQL, we now have a trust issue: The Debian repository cannot be trusted.
- astrodust 9y ago
  Fedora made the same decision, so I don't know if you can blame Debian per-se. This was a community wide problem.
  - Conan_Kudo 9y ago
    Not exactly. Fedora maintains MySQL as "community-mysql"[1], and MariaDB uses the "mariadb"[2] package. [1]: https://apps.fedoraproject.org/packages/community-mysql https://apps.fedoraproject.org/packages/community-mysql [2]: https://apps.fedoraproject.org/packages/mariadb https://apps.fedoraproject.org/packages/mariadb
    - astrodust 9y ago
      `dnf install mysql` gives you MariaDB by default.
- kasabali 9y ago
  MySQL is not available in Debian repository since MariaDB has replaced it. mysql-server package installs mariadb so that they can handle upgrades gracefully in a way that won't leave existing users in cold. They would choose to do it the way you said but then the people who are upgrading their systems would be annoyed instead of you. Tough choice but either way it's a minor annoyance to be honest. Addition: Also it's not as if it isn't very clear what you're installing: $ apt install mysql-server .... The following NEW packages will be installed: default-mysql-server galera-3 libdbd-mysql-perl libhtml-template-perl libterm-readkey-perl mariadb-client-10.1 mariadb-client-core-10.1 mariadb-common mariadb-server-10.1 mariadb-server-core-10.1 mysql-server .... $ man mysql MYSQL(1) MariaDB Database System MYSQL(1) NAME mysql - the MariaDB command-line tool .... It is not aim of distribution maintainers to hide facts or make you use counterfeit programs, they just want to help users with transition.
  - ocdtrekkie 9y ago
    It isn't correct to "upgrade" someone to a different piece of software, and it definitely wasn't "graceful". The whole source of my rage comes from the fact that everything was inexplicably broken and I did not know why. If Debian doesn't have a piece of software, it shouldn't update it. It should leave it alone. (And bear in mind, I was working from a script, so unless I sit there reading every line while it builds the VM, all of this unauthorized breakage of my machine is silent and without consulting me.) And of course, the response to "man mysql" makes no sense, because MariaDB is not MySQL.
    - kasabali 9y ago
      > It isn't correct to "upgrade" someone to a different piece of software, and it definitely wasn't "graceful". The whole source of my rage comes from the fact that everything was inexplicably broken and I did not know why. > And of course, the response to "man mysql" makes no sense, because MariaDB is not MySQL. MariaDB was supposed to be a drop-in replacement. This is why Debian (and other distros like Fedora) chose to name it and help transition of existing users. Distributions tried their best to make it as painless as possible. Sorry it wasn't the case for you but I guess it still helped more people than it hurt. > (And bear in mind, I was working from a script, so unless I sit there reading every line while it builds the VM, all of this unauthorized breakage of my machine is silent and without consulting me.) It was documented in Release Notes [0]. You should've read it before upgrading your script. It is always a good idea to read it regardless of this specific issue. Even if you didn't read release notes, banner text of `mysql' command makes it very clear it's MariaDB: $ mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 32 Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1 [0]: https://www.debian.org/releases/stable/amd64/release-notes/ch-whats-new.en.html#mariadb-replaces-mysql https://www.debian.org/releases/stable/amd64/release-notes/c...
      - ivanhoe 9y ago
        > MariaDB was supposed to be a drop-in replacement. "Supposed to" is a key point here, cause it's not: Explain works different if you need a certain thread info, AFAIK no JSON data type, GIS functions are different, lots of subtle differences that will bite you in the arse if you presume it's exactly the same engine. And as the time goes by the list of differences is just growing.
- forgottenpass 9y ago
  "White hot rage," "anguish," "trust issue"? Transitional packages are a source of confusion that are never fun, but this still sounds usually harrowing for dealing with the bumps of upgrading servers to a new OS major version. Just how rushed and close to the wire was your deployment?
  - ocdtrekkie 9y ago
    Coming from predominantly the Windows world, I never expected a Linux machine to silently go so far into being Microsoft. Installing software that was not authorized on someone's machine is a serious security compromise.
    - m45t3r 9y ago
      Most people wouldn't blind update Windows versions (specially in a working environment), yet you updated your distro in a working environment without looking at release notes and are blaming the developers? Just learn from your mistakes and carry on.
    - dspillett 9y ago
      > Coming from predominantly the Windows world, I never expected a Linux machine to silently go so far into being Microsoft. This is a common mistake: you are conflating Linux and Debian. You don't have a Linux operating system, you have a Debian operating system and services & applications package (a "distribution") that happens to use the Linux kernel and other common parts associated (though in many cases not exclusively) with the Linux ecosystem. MS wouldn't touch MySQL in an update because they never provided it for you. They might break it with changes that the upgrade makes and it isn't their responsibility not to (if you kept MySQL updated then you'd be fine as the maintainers would be aware of breaking changes in the OS and would have released updates to handle them ahead of time - but the onus here is on you to monitor that situation). They wouldn't change the operation of the DBMS they provide with the OS because there is no DBMS provided with the OS for them to break. A fairer comparison is MS updating IE with Windows upgrades, potentially breaking maintained web sites/apps that depend on non-standard and/or undefined behaviours in older versions of IE. Windows releases do often break other software, as do SQL Server release upgrades, as any major update of that sort does which is why thorough testing before releasing to production or otherwise mission-critical environments is essential. > Installing software that was not authorized on someone's machine is a serious security compromise. The release notes quite clearly state that it is going to happen. By installing the release you effectively authorised the process. And "serious security compromise" is hyperbole here IMO. A functionality compromise, yes, so effectively a DoS, but only for software more manually installed that is therefore not Debian's responsibility to keep compatibility with at all, and by installing the update without understanding it when the documentation was there to read you DoSed yourself. While we are throwing around hyperbolic statements of blame: Not understanding the nature of the release update by at least reading through the release notes, and not testing an update in a pre-production environment, are both serious due diligence failures. If the upgrade had left a (now unmaintained) mySQL install in-place with warnings in the documentation someone who didn't read that documentation wouldn't have seen the warnings any more than they would see the notes about the switch from mysql to mariadb so would have been left with a potentially insecure environment down the line as flaws are found by remain unpatched as Debian don't support mysql packages in that release. If they had simply dropped the package your system would have been completely broken without manual intervention to install mariadb in its stead leaving your environment (more) broken. The only way to keep everyone happy would be to keep maintaining both sets of packages, which, lo and behold, for all intents & purposes they do trough the LTS program: current old-stable is effectively supported until April 2020 so if you must keep mysql for compatibility purposes with software not provided as part of the distribution then you can keep using that for a while yet giving you nearly two more years to find a solution (waiting for that software made compatible with mariadb, finding an alternative to it, using mysql from another source (compiled locally or through a third party package repo, or moving to a Linux-based OS that does maintain mysql packages).
PaulHoule 9y ago
My experience has been that MariaDB is NOT a drop-in replacement for MySQL.
- ocdtrekkie 9y ago
  Indeed. My issue with not being able to trust them to install what I tell them to install aside: If MariaDB had actually "just worked", I probably wouldn't have even noticed.
- astrodust 9y ago
  It was when they'd just forked, but over the years they have diverged. You could argue this was inevitable, but it was a product of the conditions at the time.
  - ocdtrekkie 9y ago
    But that time is not when Debian decided to install their software on my machine. They chose to patch over MySQL 5.5 with MariaDB 10.1 in 2017, and I'm going to judge them on that decision.
    - sangnoir 9y ago
      > But that time is not when Debian decided to install their software on my machine No, you installed their software on your machine without reading the release notes.
RealSpamapS 9y ago
To be clear, those who were maintaining MySQL at the time this decision was made were perfectly happy maintaining both (I am one of those people, sort of, not very active the last couple years). The security team and release team is to blame, please direct your complaints to them. https://tracker.debian.org/pkg/mysql-5.7 https://tracker.debian.org/pkg/mysql-5.7

ocdtrekkie 9y ago

To be clear: I have no issue with Debian shipping MariaDB. I have an issue with Debian pretending MariaDB is MySQL. If I run "apt-get install mysql-server" and get something other than MySQL, we now have a trust issue: The Debian repository cannot be trusted.

astrodust 9y ago
Fedora made the same decision, so I don't know if you can blame Debian per-se. This was a community wide problem.
- Conan_Kudo 9y ago
  Not exactly. Fedora maintains MySQL as "community-mysql"[1], and MariaDB uses the "mariadb"[2] package. [1]: https://apps.fedoraproject.org/packages/community-mysql https://apps.fedoraproject.org/packages/community-mysql [2]: https://apps.fedoraproject.org/packages/mariadb https://apps.fedoraproject.org/packages/mariadb
  - astrodust 9y ago
    `dnf install mysql` gives you MariaDB by default.
kasabali 9y ago
MySQL is not available in Debian repository since MariaDB has replaced it. mysql-server package installs mariadb so that they can handle upgrades gracefully in a way that won't leave existing users in cold. They would choose to do it the way you said but then the people who are upgrading their systems would be annoyed instead of you. Tough choice but either way it's a minor annoyance to be honest. Addition: Also it's not as if it isn't very clear what you're installing: $ apt install mysql-server .... The following NEW packages will be installed: default-mysql-server galera-3 libdbd-mysql-perl libhtml-template-perl libterm-readkey-perl mariadb-client-10.1 mariadb-client-core-10.1 mariadb-common mariadb-server-10.1 mariadb-server-core-10.1 mysql-server .... $ man mysql MYSQL(1) MariaDB Database System MYSQL(1) NAME mysql - the MariaDB command-line tool .... It is not aim of distribution maintainers to hide facts or make you use counterfeit programs, they just want to help users with transition.
- ocdtrekkie 9y ago
  It isn't correct to "upgrade" someone to a different piece of software, and it definitely wasn't "graceful". The whole source of my rage comes from the fact that everything was inexplicably broken and I did not know why. If Debian doesn't have a piece of software, it shouldn't update it. It should leave it alone. (And bear in mind, I was working from a script, so unless I sit there reading every line while it builds the VM, all of this unauthorized breakage of my machine is silent and without consulting me.) And of course, the response to "man mysql" makes no sense, because MariaDB is not MySQL.
  - kasabali 9y ago
    > It isn't correct to "upgrade" someone to a different piece of software, and it definitely wasn't "graceful". The whole source of my rage comes from the fact that everything was inexplicably broken and I did not know why. > And of course, the response to "man mysql" makes no sense, because MariaDB is not MySQL. MariaDB was supposed to be a drop-in replacement. This is why Debian (and other distros like Fedora) chose to name it and help transition of existing users. Distributions tried their best to make it as painless as possible. Sorry it wasn't the case for you but I guess it still helped more people than it hurt. > (And bear in mind, I was working from a script, so unless I sit there reading every line while it builds the VM, all of this unauthorized breakage of my machine is silent and without consulting me.) It was documented in Release Notes [0]. You should've read it before upgrading your script. It is always a good idea to read it regardless of this specific issue. Even if you didn't read release notes, banner text of `mysql' command makes it very clear it's MariaDB: $ mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 32 Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1 [0]: https://www.debian.org/releases/stable/amd64/release-notes/ch-whats-new.en.html#mariadb-replaces-mysql https://www.debian.org/releases/stable/amd64/release-notes/c...
    - ivanhoe 9y ago
      > MariaDB was supposed to be a drop-in replacement. "Supposed to" is a key point here, cause it's not: Explain works different if you need a certain thread info, AFAIK no JSON data type, GIS functions are different, lots of subtle differences that will bite you in the arse if you presume it's exactly the same engine. And as the time goes by the list of differences is just growing.
forgottenpass 9y ago
"White hot rage," "anguish," "trust issue"? Transitional packages are a source of confusion that are never fun, but this still sounds usually harrowing for dealing with the bumps of upgrading servers to a new OS major version. Just how rushed and close to the wire was your deployment?
- ocdtrekkie 9y ago
  Coming from predominantly the Windows world, I never expected a Linux machine to silently go so far into being Microsoft. Installing software that was not authorized on someone's machine is a serious security compromise.
  - m45t3r 9y ago
    Most people wouldn't blind update Windows versions (specially in a working environment), yet you updated your distro in a working environment without looking at release notes and are blaming the developers? Just learn from your mistakes and carry on.
  - dspillett 9y ago
    > Coming from predominantly the Windows world, I never expected a Linux machine to silently go so far into being Microsoft. This is a common mistake: you are conflating Linux and Debian. You don't have a Linux operating system, you have a Debian operating system and services & applications package (a "distribution") that happens to use the Linux kernel and other common parts associated (though in many cases not exclusively) with the Linux ecosystem. MS wouldn't touch MySQL in an update because they never provided it for you. They might break it with changes that the upgrade makes and it isn't their responsibility not to (if you kept MySQL updated then you'd be fine as the maintainers would be aware of breaking changes in the OS and would have released updates to handle them ahead of time - but the onus here is on you to monitor that situation). They wouldn't change the operation of the DBMS they provide with the OS because there is no DBMS provided with the OS for them to break. A fairer comparison is MS updating IE with Windows upgrades, potentially breaking maintained web sites/apps that depend on non-standard and/or undefined behaviours in older versions of IE. Windows releases do often break other software, as do SQL Server release upgrades, as any major update of that sort does which is why thorough testing before releasing to production or otherwise mission-critical environments is essential. > Installing software that was not authorized on someone's machine is a serious security compromise. The release notes quite clearly state that it is going to happen. By installing the release you effectively authorised the process. And "serious security compromise" is hyperbole here IMO. A functionality compromise, yes, so effectively a DoS, but only for software more manually installed that is therefore not Debian's responsibility to keep compatibility with at all, and by installing the update without understanding it when the documentation was there to read you DoSed yourself. While we are throwing around hyperbolic statements of blame: Not understanding the nature of the release update by at least reading through the release notes, and not testing an update in a pre-production environment, are both serious due diligence failures. If the upgrade had left a (now unmaintained) mySQL install in-place with warnings in the documentation someone who didn't read that documentation wouldn't have seen the warnings any more than they would see the notes about the switch from mysql to mariadb so would have been left with a potentially insecure environment down the line as flaws are found by remain unpatched as Debian don't support mysql packages in that release. If they had simply dropped the package your system would have been completely broken without manual intervention to install mariadb in its stead leaving your environment (more) broken. The only way to keep everyone happy would be to keep maintaining both sets of packages, which, lo and behold, for all intents & purposes they do trough the LTS program: current old-stable is effectively supported until April 2020 so if you must keep mysql for compatibility purposes with software not provided as part of the distribution then you can keep using that for a while yet giving you nearly two more years to find a solution (waiting for that software made compatible with mariadb, finding an alternative to it, using mysql from another source (compiled locally or through a third party package repo, or moving to a Linux-based OS that does maintain mysql packages).

PaulHoule 9y ago

My experience has been that MariaDB is NOT a drop-in replacement for MySQL.

ocdtrekkie 9y ago
Indeed. My issue with not being able to trust them to install what I tell them to install aside: If MariaDB had actually "just worked", I probably wouldn't have even noticed.
astrodust 9y ago
It was when they'd just forked, but over the years they have diverged. You could argue this was inevitable, but it was a product of the conditions at the time.
- ocdtrekkie 9y ago
  But that time is not when Debian decided to install their software on my machine. They chose to patch over MySQL 5.5 with MariaDB 10.1 in 2017, and I'm going to judge them on that decision.
  - sangnoir 9y ago
    > But that time is not when Debian decided to install their software on my machine No, you installed their software on your machine without reading the release notes.

RealSpamapS 9y ago

To be clear, those who were maintaining MySQL at the time this decision was made were perfectly happy maintaining both (I am one of those people, sort of, not very active the last couple years). The security team and release team is to blame, please direct your complaints to them. https://tracker.debian.org/pkg/mysql-5.7 https://tracker.debian.org/pkg/mysql-5.7