5 ms·
I think many steer clear of sid because of the security policy: Please note that security updates for "unstable" distribution are not managed by the security t
by dv_dt 5y ago
I think many steer clear of sid because of the security policy:
Please note that security updates for "unstable" distribution are not managed by the security team. Hence, "unstable" does not get security updates in a timely manner. [1]
[1] https://www.debian.org/releases/sid/ https://www.debian.org/releases/sid/
- goodpoint 5y agoThis phrasing is very misleading. Sid/Unstable and Testing track upstream releases. If an upstream developer releases a new version to fix a vulnerability, Sid gets the upstream fix just like other rolling distro. If a version in Testing has a vulnerability and Testing entered a pre-release freeze the fix gets backported. If a version in Stable has a vulnerability the fix gets backported. This is designed to provide the "best of both worlds".
- dv_dt 5y agoWhile this does cover quite a bit, I think there is a little more that the security team does in terms of coordination, encouraging or even making timely package updates. It’s understandable that some would fall on either side of being ok with that gap or not.