3 ms·

> You make it sound like an irrational fear but there's a real cost/benefit ratio to consider when you upgrade a machine. 95+% of users have no chance of even

> You make it sound like an irrational fear but there's a real cost/benefit ratio to consider when you upgrade a machine. 95+% of users have no chance of even making this cost-benefit analysis because they cannot assess the scope or risk associated with the upgrade even if they wanted to. They have to rely on vendors making those assessments for them.

zozbot234 7y ago
> They have to rely on vendors making those assessments for them. That's why I run Debian stable, which provides security updates and critical bugfixes for 5 years or more post-release with very limited changes otherwise. Maximized benefit, minimal cost.
- bbarnett 7y ago
  That's actually untrue. FYI -- use Debian almost exclusively, been doing so for 20+ years and love it. (Well mostly, the last 5-7 years have been rough though.) What Debian provides, is security updates for 1 year after the next stable release. That's it. '5 years' is via LTS is volunteer support, provided by corporate and private donations, via a corporation in France. Their goal is to extend Debian oldstable's lifespan. The entire process is absolutely not the same as updates when running Debian stable. For example, due to its volunteer nature, companies get to decide where they 'put their money'. What packages are prioritized. Rare / unused packages may never be addressed, depending upon funding. Use PHP? Apache? The Linux Kernel? Sure, you'll see updates! Use rare package $x, and that may not happen, even though Debian Security would handle it. I can also tell you via experience, that QA is not quite as good as Debian proper. Still, is it a good thing? Sure! Is it managed by the Debian security team, 100% embracing all of its methods, and so on? NO. I felt it is important for you (and others) to know this. It's not as stable as Debian, not managed by Debian, and should ONLY be used as a stop-gap. You want stable? Stay on Debian managed security updates!
simias 7y ago
I'd argue that almost 100% of users, myself included, can't really make this analysis for any given update. Usually you can't anticipate what will brake, that's what makes upgrades scary. What everybody does however is to use past experiences to evaluate the risks. Who hasn't had a system upgrade break something that took a while to fix? In these conditions, who wants their system to auto-update if the system is critical and it could happen at the worst possible moment? As I said I try to keep my system up to date, but if I know that I have an important deadline in the near future I'm likely to postpone updates to avoid shooting myself in the foot.

zozbot234 7y ago

> They have to rely on vendors making those assessments for them. That's why I run Debian stable, which provides security updates and critical bugfixes for 5 years or more post-release with very limited changes otherwise. Maximized benefit, minimal cost.

bbarnett 7y ago
That's actually untrue. FYI -- use Debian almost exclusively, been doing so for 20+ years and love it. (Well mostly, the last 5-7 years have been rough though.) What Debian provides, is security updates for 1 year after the next stable release. That's it. '5 years' is via LTS is volunteer support, provided by corporate and private donations, via a corporation in France. Their goal is to extend Debian oldstable's lifespan. The entire process is absolutely not the same as updates when running Debian stable. For example, due to its volunteer nature, companies get to decide where they 'put their money'. What packages are prioritized. Rare / unused packages may never be addressed, depending upon funding. Use PHP? Apache? The Linux Kernel? Sure, you'll see updates! Use rare package $x, and that may not happen, even though Debian Security would handle it. I can also tell you via experience, that QA is not quite as good as Debian proper. Still, is it a good thing? Sure! Is it managed by the Debian security team, 100% embracing all of its methods, and so on? NO. I felt it is important for you (and others) to know this. It's not as stable as Debian, not managed by Debian, and should ONLY be used as a stop-gap. You want stable? Stay on Debian managed security updates!

simias 7y ago

I'd argue that almost 100% of users, myself included, can't really make this analysis for any given update. Usually you can't anticipate what will brake, that's what makes upgrades scary. What everybody does however is to use past experiences to evaluate the risks. Who hasn't had a system upgrade break something that took a while to fix? In these conditions, who wants their system to auto-update if the system is critical and it could happen at the worst possible moment? As I said I try to keep my system up to date, but if I know that I have an important deadline in the near future I'm likely to postpone updates to avoid shooting myself in the foot.