4 ms·

Be aware that Testing may get security updates much later than Unstable or Stable. https://www.debian.org/security/faq#testing https://www.debian.org/security/

Be aware that Testing may get security updates much later than Unstable or Stable. https://www.debian.org/security/faq#testing https://www.debian.org/security/faq#testing

lucb1e 6y ago
Does that actually happen in practice though? And as for the severity, we're talking desktops so the most critical piece of software is the browser. Firefox is the only piece of software I download outside of the repositories to make sure the updates come directly from the source, but other than that, openssh very rarely has serious vulnerabilities, to attack Thunderbird you'd already need to mitm my traffic... it's all rather unlikely.
- ohazi 6y ago
  The only guarantee that the Debian project makes is that the stable branch is the security team's main priority. In practice, I've found that unstable and testing usually get patches pretty quickly.
- ufo 6y ago
  It is particularly bad during the freeze before the new stable version comes out. Some updates can be delayed for months.
  - lucb1e 6y ago
    Also security updates? Wouldn't that make the new version insecure at launch until someone pushes a thousand security updates at once (making it kind of 'testing' again because none of these were in testing before and thus haven't been widely tested)? You raise a good point since I notice I don't know the process as well as I thought I did, but it seems odd that the frozen testing repo would only get all security updates all at once months later.
    - ufo 6y ago
      IIRC, Debian testing doesn't have a separate channel for security updates. Security updates are handled like regular updates: they start on Debian unstable and then flow down to Debian testing. The Debian wiki mentions that delays can be specially large after a new release comes out. I don't know if I was misremembering it or if it can be problematic both before and after a stable release comes out. Hopefully someone with more Debian experience can clear this up. https://www.debian.org/security/faq#testing https://www.debian.org/security/faq#testing
      - ohazi 6y ago
        This certainly used to be the case. There appears to be an actual channel now, though: http://security.debian.org/debian-security/dists/testing-security/ http://security.debian.org/debian-security/dists/testing-sec... I don't know if anything actually shows up here, but you no longer get the error for security.debian.org when you try to upgrade via s/stable/testing/ in sources.list.
- yyyk 6y ago
  Firefox is a rather good example - the update to Firefox esr 68 (from esr 60) came far later in testing than either unstable or stable. Given that some trigger happy devs remove support from old versions as soon as they leave support, this can directly affect browsing experience.

Be aware that Testing may get security updates much later than Unstable or Stable. https://www.debian.org/security/faq#testing https://www.debian.org/security/faq#testing

lucb1e 6y ago

Does that actually happen in practice though? And as for the severity, we're talking desktops so the most critical piece of software is the browser. Firefox is the only piece of software I download outside of the repositories to make sure the updates come directly from the source, but other than that, openssh very rarely has serious vulnerabilities, to attack Thunderbird you'd already need to mitm my traffic... it's all rather unlikely.

ohazi 6y ago
The only guarantee that the Debian project makes is that the stable branch is the security team's main priority. In practice, I've found that unstable and testing usually get patches pretty quickly.
ufo 6y ago
It is particularly bad during the freeze before the new stable version comes out. Some updates can be delayed for months.
- lucb1e 6y ago
  Also security updates? Wouldn't that make the new version insecure at launch until someone pushes a thousand security updates at once (making it kind of 'testing' again because none of these were in testing before and thus haven't been widely tested)? You raise a good point since I notice I don't know the process as well as I thought I did, but it seems odd that the frozen testing repo would only get all security updates all at once months later.
  - ufo 6y ago
    IIRC, Debian testing doesn't have a separate channel for security updates. Security updates are handled like regular updates: they start on Debian unstable and then flow down to Debian testing. The Debian wiki mentions that delays can be specially large after a new release comes out. I don't know if I was misremembering it or if it can be problematic both before and after a stable release comes out. Hopefully someone with more Debian experience can clear this up. https://www.debian.org/security/faq#testing https://www.debian.org/security/faq#testing
    - ohazi 6y ago
      This certainly used to be the case. There appears to be an actual channel now, though: http://security.debian.org/debian-security/dists/testing-security/ http://security.debian.org/debian-security/dists/testing-sec... I don't know if anything actually shows up here, but you no longer get the error for security.debian.org when you try to upgrade via s/stable/testing/ in sources.list.
yyyk 6y ago
Firefox is a rather good example - the update to Firefox esr 68 (from esr 60) came far later in testing than either unstable or stable. Given that some trigger happy devs remove support from old versions as soon as they leave support, this can directly affect browsing experience.