3 ms·

Problem with Debian that by the time of the release all packages are heavily outdated. Ubuntu is even worse - they can't even patch multiple vulnerabilities, se

by xvilka 6y ago

Problem with Debian that by the time of the release all packages are heavily outdated. Ubuntu is even worse - they can't even patch multiple vulnerabilities, see, for example, radare2 package[1]. Everything that is required just a simple version bump. It's often not a problem for other distributions like Fedora, Arch, Gentoo, etc. [1] https://bugs.launchpad.net/ubuntu/+source/radare2/+bug/1882889 https://bugs.launchpad.net/ubuntu/+source/radare2/+bug/18828...

hyper_reality 6y ago
This is a misunderstanding of the purpose of Debian, which comes in several flavours: Stable, Testing, and Unstable. Stable does indeed "lock" older versions of packages, but this comes with the enormous benefit of reducing maintenance caused by bugs, regressions and incompatabilities that occur in newer releases. Only security updates are released, but there are also methods for installing newer versions of packages if you like, which is exactly what I want from a server operating system. If you are looking for more of a Fedora or Arch-like experience on desktop, then you could investigate Debian Testing or Unstable. As for the radare2 security issues, it appears that the package is part of the Ubuntu universe or community repository, and has been abandoned by its maintainer. It won't receive any official support from Canonical. It's probably a bad thing that Ubuntu allows this in a way that's not super clear to the end-user, however the best solution would be for somebody to step up to the role of maintaining the package, or for it to get removed from the universe repository altogether.
- yyyk 6y ago
  Debian-Testing is the worst of both worlds. It doesn't get updated as frequently as -unstable and doesn't get security fixes in time like -stable. e.g. firefox-esr was on 68.11.0 for two months until in the last few days it finally switched to 72.3.0. So users were running a vulnerable version all that time [i.e. they never got even 68.12.0]. https://tracker.debian.org/pkg/firefox-esr https://tracker.debian.org/pkg/firefox-esr
  - kelnos 6y ago
    I consider the in-between nature of Testing to be a feature. Less-frequent updates than Unstable drastically reduces breakage, but I still get new stuff. The lack of timely security updates does unfortunately mean I have to be a little more vigilant. I usually run Stable for about 6 months after its first major release, since Testing often has a lot of churn then, and sometimes breaks. I've been running this way on my desktop machine since Stretch was Testing and have been really happy with it. For apps like Firefox, I run the upstream version anyway, which auto-updates on upstream's schedule.
cpuguy83 6y ago
This is the problem when relying on distros to build and distribute all your software. They also don't want to break people running on a given version of the distro. So typically whatever is stable at the time that the distro version is released is the version that stays for the life of that distro version. Package maintainers do usually do backports for important bug/security fixes, though. If there is a particular problem, best to raise it on the bug tracker for the distro.

by xvilka 6y ago

hyper_reality 6y ago

This is a misunderstanding of the purpose of Debian, which comes in several flavours: Stable, Testing, and Unstable. Stable does indeed "lock" older versions of packages, but this comes with the enormous benefit of reducing maintenance caused by bugs, regressions and incompatabilities that occur in newer releases. Only security updates are released, but there are also methods for installing newer versions of packages if you like, which is exactly what I want from a server operating system. If you are looking for more of a Fedora or Arch-like experience on desktop, then you could investigate Debian Testing or Unstable. As for the radare2 security issues, it appears that the package is part of the Ubuntu universe or community repository, and has been abandoned by its maintainer. It won't receive any official support from Canonical. It's probably a bad thing that Ubuntu allows this in a way that's not super clear to the end-user, however the best solution would be for somebody to step up to the role of maintaining the package, or for it to get removed from the universe repository altogether.

yyyk 6y ago
Debian-Testing is the worst of both worlds. It doesn't get updated as frequently as -unstable and doesn't get security fixes in time like -stable. e.g. firefox-esr was on 68.11.0 for two months until in the last few days it finally switched to 72.3.0. So users were running a vulnerable version all that time [i.e. they never got even 68.12.0]. https://tracker.debian.org/pkg/firefox-esr https://tracker.debian.org/pkg/firefox-esr
- kelnos 6y ago
  I consider the in-between nature of Testing to be a feature. Less-frequent updates than Unstable drastically reduces breakage, but I still get new stuff. The lack of timely security updates does unfortunately mean I have to be a little more vigilant. I usually run Stable for about 6 months after its first major release, since Testing often has a lot of churn then, and sometimes breaks. I've been running this way on my desktop machine since Stretch was Testing and have been really happy with it. For apps like Firefox, I run the upstream version anyway, which auto-updates on upstream's schedule.

cpuguy83 6y ago

This is the problem when relying on distros to build and distribute all your software. They also don't want to break people running on a given version of the distro. So typically whatever is stable at the time that the distro version is released is the version that stays for the life of that distro version. Package maintainers do usually do backports for important bug/security fixes, though. If there is a particular problem, best to raise it on the bug tracker for the distro.