3 ms·

How many of those vulnerabilities have patches available ?

jeroenhd 5y ago
From what I can tell, the problem with these packages is that the security fixes need to be backported into earlier versions of packages because upstream fixed them in major version releases. Chromium 90 does not contain all security fixes found in Chromium 93 so there are tons of CVEs open on Debian systems still rocking Chromium 90. Most packages have fixes available but Debian doesn't have the manpower to backport every single security fix for every single package. This is a result of the way their project is structured: they guarantee that no major software updates happen within Debian releases, helping you get a completely stable system, but that comes at the cost of an incredible amount of work for the Debian maintainers. Debian chooses to modify or repackage upstream versions for compatibility or branding purposes (to the ire of many open source developers, like notably that guy that made XScreenSaver. I'd link to his rant about it, but his website shows some angry rant when HN is in the referer header...) That means that maintainers still need to do manual work even when upstream has already provided them with a fix for the latest version supported in Debian. This is why I prefer to run packages from repositories maintained by the developers themselves rather than relying on Debian's maintainers. The risk of needing to update config or check for breaking changes is much higher, but the security risk and patch cycle length is much lower. Even for browsers that release actively-abused 0day patches it can take up to a day or longer for some distributions to update their packages.
- robocat 5y ago
  > XScreenSaver. I'd link to his rant about it, but his website shows some angry rant when HN is in the referer header. Here’s the link I think: https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop-shipping-xscreensaver/ https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop...

From what I can tell, the problem with these packages is that the security fixes need to be backported into earlier versions of packages because upstream fixed them in major version releases. Chromium 90 does not contain all security fixes found in Chromium 93 so there are tons of CVEs open on Debian systems still rocking Chromium 90. Most packages have fixes available but Debian doesn't have the manpower to backport every single security fix for every single package. This is a result of the way their project is structured: they guarantee that no major software updates happen within Debian releases, helping you get a completely stable system, but that comes at the cost of an incredible amount of work for the Debian maintainers. Debian chooses to modify or repackage upstream versions for compatibility or branding purposes (to the ire of many open source developers, like notably that guy that made XScreenSaver. I'd link to his rant about it, but his website shows some angry rant when HN is in the referer header...) That means that maintainers still need to do manual work even when upstream has already provided them with a fix for the latest version supported in Debian. This is why I prefer to run packages from repositories maintained by the developers themselves rather than relying on Debian's maintainers. The risk of needing to update config or check for breaking changes is much higher, but the security risk and patch cycle length is much lower. Even for browsers that release actively-abused 0day patches it can take up to a day or longer for some distributions to update their packages.

robocat 5y ago
> XScreenSaver. I'd link to his rant about it, but his website shows some angry rant when HN is in the referer header. Here’s the link I think: https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop-shipping-xscreensaver/ https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop...