4 ms·

Why should any company buy this? Does that mean, that these security updates are exclusive to Ubuntu Pro and everybody else won't get Vulnerabilities fixed? Ar

Why should any company buy this? Does that mean, that these security updates are exclusive to Ubuntu Pro and everybody else won't get Vulnerabilities fixed? Aren't security upgrades anyway getting deployed - I mean, if Canonical would hold bug fixes for Vulnerabilities back, then obviously the community would switch to a different Linux Distro? Especially this sentence makes me wondering: "Many zero-day vulnerabilities addressed under embargo, with critical CVEs patched in less than 24h on average" => This sounds like Canonical holds back zero-day vulnerabilities for not-paying users!

nicce 4y ago
Hopefully it just means extended duration for getting patches. If not… yikes.
akdor1154 4y ago
From TFA: > Ubuntu Pro expands security coverage for critical, high and medium Common Vulnerabilities and Exposures (CVEs) to thousands of applications and toolchains, including Ansible, Apache Tomcat, Apache Zookeeper, Docker, Drupal, Nagios, Node.js, phpMyAdmin, Puppet, PowerDNS, Python 2, Redis, Rust, WordPress, and more. So sounds like coverage of a bunch of stuff in their Universe repository that is not part of the base system. Though I found my own thing to whinge about, on https://ubuntu.com/security https://ubuntu.com/security: > Ubuntu [...] includes access to: > - ... > - Knowledge Base: a private archive of expert-written articles and tutorials Wait what?
- emj 4y ago
  > > - Knowledge Base: a private archive Common thing for enterprise customers, I can not speak for Ubuntu but usually they are private because they are filled with bad articles and tutorials that no one would pay for. Sounds good though.
fulafel 4y ago
Souns like it's security updates for otherwise out of support versions, 16.04, like MS sells (sold?) for Windows XP.
stubish 4y ago
Ubuntu LTS is only 5 years, and only for the core (the server stuff really, the 'main' and 'restricted' repos). Desktop and other 'universe' stuff has a shorter time frame. After 5 years, companies wanting to keep running older versions of the OS require 3rd party security updates at a minimum for compliance issues, even if they think they can protect themselves and their customers without it. This was Ubuntu Advantage and Extended Security Maintenance (ESM). And now it seems Ubuntu Pro. UA lots of people got for free, either due to only needing a few seats or it being included with their cloud. But bigger shops with their own hardware would need to pay, or get to explain to the media why they didn't bother if they get breached.

nicce 4y ago

Hopefully it just means extended duration for getting patches. If not… yikes.

akdor1154 4y ago

From TFA: > Ubuntu Pro expands security coverage for critical, high and medium Common Vulnerabilities and Exposures (CVEs) to thousands of applications and toolchains, including Ansible, Apache Tomcat, Apache Zookeeper, Docker, Drupal, Nagios, Node.js, phpMyAdmin, Puppet, PowerDNS, Python 2, Redis, Rust, WordPress, and more. So sounds like coverage of a bunch of stuff in their Universe repository that is not part of the base system. Though I found my own thing to whinge about, on https://ubuntu.com/security https://ubuntu.com/security: > Ubuntu [...] includes access to: > - ... > - Knowledge Base: a private archive of expert-written articles and tutorials Wait what?

emj 4y ago
> > - Knowledge Base: a private archive Common thing for enterprise customers, I can not speak for Ubuntu but usually they are private because they are filled with bad articles and tutorials that no one would pay for. Sounds good though.

fulafel 4y ago

Souns like it's security updates for otherwise out of support versions, 16.04, like MS sells (sold?) for Windows XP.

stubish 4y ago

Ubuntu LTS is only 5 years, and only for the core (the server stuff really, the 'main' and 'restricted' repos). Desktop and other 'universe' stuff has a shorter time frame. After 5 years, companies wanting to keep running older versions of the OS require 3rd party security updates at a minimum for compliance issues, even if they think they can protect themselves and their customers without it. This was Ubuntu Advantage and Extended Security Maintenance (ESM). And now it seems Ubuntu Pro. UA lots of people got for free, either due to only needing a few seats or it being included with their cloud. But bigger shops with their own hardware would need to pay, or get to explain to the media why they didn't bother if they get breached.