3 ms·
In production you want what-dylan604-calls-stagnant instead of running the latest of the greatest. Yeah, I get it that you run Arch Linux on your laptop which h
by Fnoord 5y ago
In production you want what-dylan604-calls-stagnant instead of running the latest of the greatest. Yeah, I get it that you run Arch Linux on your laptop which has zero production relevance (nobody cares if you blow it up). But on a production system, where other people rely on, you don't want sudden surprises. Or, well, maybe you do, but those people who rely on it certainly don't.
- dylan604 5y agoIf a known vuln is a stable version is exploited in the wild and left alone, why is that considered good?
- Fnoord 5y agoThat only happens in old Stable, the previous version of Stable, or machines without internet, or machines which don't receive manual maintenance (otherwise you'd need apt install unattended-upgrades). In Stable (what you call Stagnant) vulns get backported. Only the code fixing the vulnerability gets updated, the rest is left untouched. Its how Apple deals with older iOS versions, and it keeps their happy users of older devices happy. If I run some old piece of hardware/software, there are a few things I want: I want it to keep functioning the way I bought it, and I want it to remain secure and reliable. So what I want is security and reliability fixes ie. what Debian Stable (and e.g. Ubuntu LTS) receives.
- beermonster 5y ago> in Stable (what you call Stagnant) vulns get backported. This isn’t always possible. And sometimes creates more problems than it solves or ends up not mitigating the issue completely. In any case, backporting is a slower process. And back ports for non-stable are not done by the security team but volunteers.
- Fnoord 5y agoI was on about security and reliability fixes. These are applied when you run Stable, via Security repository, enabled by default. I was not on about Backports repository.