4 ms·

Oh cool. As for CloudLinux, "not free" probably scale for some hosting environments, including non-managed cloud instances. But something like Springdale, give

by apecat 6y ago

Oh cool. As for CloudLinux, "not free" probably scale for some hosting environments, including non-managed cloud instances. But something like Springdale, given resources, might be able to provide. They're still tracking RHEL 7, though. Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software. Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited. OpenSUSE Leap versions seem to get three years, which really isn't enough software that needs to just work for a long while.

zxspectrum1982 6y ago
Springdale Linux is on RHEL 8.3 but their homepage is awfully out of date. Here's the full ISO for 8.1: http://puias.princeton.edu/data/puias/8.1/x86_64/iso/ http://puias.princeton.edu/data/puias/8.1/x86_64/iso/ And then you can add the repos to update to 8.3: http://puias.princeton.edu/data/puias/8.3/ http://puias.princeton.edu/data/puias/8.3/ Or you can take the small ("boot") ISO and install 8.3 directy: http://puias.princeton.edu/data/puias/8.3/x86_64/os/images/ http://puias.princeton.edu/data/puias/8.3/x86_64/os/images/ In fact, they are even building Springdale Linux 8 for i386, which RHEL and CentOS never did. If you need more than three years on openSUSE Leap, then you need to upgrade to SUSE Linux Enterprise Server.
Thaxll 6y ago
I trust Canonical more than Debian for security fixes. Canonical has a dedicated security team.
- apecat 6y ago
  So does Debian https://security-team.debian.org https://security-team.debian.org I claim no deep expertise on this, and I assume Canonical has more money to throw at this. Or are there contributions to Debian security in the form of paid personnel? This is actually quite interesting to me, anyone with real knowledge of the subject is welcome to interject.
mekster 6y ago
> Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited. What are the track records of the claim? I'm sure Ubuntu will patch stuff up if some vulnerability shows up outside of main that gets patched upstream or elsewhere.
- apecat 6y ago
  > What are the track records of the claim? I claim no deep expertise on this, but for a distribution of 56k packages, this looks quite good https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... To anyone here who's worked secops and has to track these things, I'm really interested to hear opinions about how well Debian follows up on this
jlgaddis 6y ago
> Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software. Remember that, in Ubuntu, the majority of packages are actually ONLY supported for nine (9) months -- not the full 5 years!

by apecat 6y ago

zxspectrum1982 6y ago

Springdale Linux is on RHEL 8.3 but their homepage is awfully out of date. Here's the full ISO for 8.1: http://puias.princeton.edu/data/puias/8.1/x86_64/iso/ http://puias.princeton.edu/data/puias/8.1/x86_64/iso/ And then you can add the repos to update to 8.3: http://puias.princeton.edu/data/puias/8.3/ http://puias.princeton.edu/data/puias/8.3/ Or you can take the small ("boot") ISO and install 8.3 directy: http://puias.princeton.edu/data/puias/8.3/x86_64/os/images/ http://puias.princeton.edu/data/puias/8.3/x86_64/os/images/ In fact, they are even building Springdale Linux 8 for i386, which RHEL and CentOS never did. If you need more than three years on openSUSE Leap, then you need to upgrade to SUSE Linux Enterprise Server.

Thaxll 6y ago

I trust Canonical more than Debian for security fixes. Canonical has a dedicated security team.

apecat 6y ago
So does Debian https://security-team.debian.org https://security-team.debian.org I claim no deep expertise on this, and I assume Canonical has more money to throw at this. Or are there contributions to Debian security in the form of paid personnel? This is actually quite interesting to me, anyone with real knowledge of the subject is welcome to interject.

mekster 6y ago

> Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited. What are the track records of the claim? I'm sure Ubuntu will patch stuff up if some vulnerability shows up outside of main that gets patched upstream or elsewhere.

apecat 6y ago
> What are the track records of the claim? I claim no deep expertise on this, but for a distribution of 56k packages, this looks quite good https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... To anyone here who's worked secops and has to track these things, I'm really interested to hear opinions about how well Debian follows up on this

jlgaddis 6y ago

> Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software. Remember that, in Ubuntu, the majority of packages are actually ONLY supported for nine (9) months -- not the full 5 years!