5 ms·

Many people, myself included, don’t trust Debian. They patch too much sometimes for dubious reasons and have a poor trail record when it comes to introducing bu

Many people, myself included, don’t trust Debian. They patch too much sometimes for dubious reasons and have a poor trail record when it comes to introducing bugs. I wouldn’t use it for anything work related. I have seen Gentoo used as a base to deploy binary packages veted by the org in the past. Gentoo provides tooling to do that and it worked fine. Oracle also still sell a distribution.

candiddevmike 4y ago
What distro do you use?
- WastingMyTime89 4y ago
  For my personal server? ArchLinux, something I would never use professionally but enjoy on my machine. Packages are mostly vanilla and are updated quickly. The last software company I worked for used CentOS.
goodpoint 4y ago
Debian is well known for being the most stability and security focused among the major distros.
- HNDV 4y ago
  https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... >On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused by the removal of the following line of code from md_rand.c > MD_Update(&m,buf,j); > [ .. ] > MD_Update(&m,buf,j); /* purify complains */ >These lines were removed because they caused the Valgrind and Purify tools to produce warnings about the use of uninitialized data in any code that was linked to OpenSSL. You can see one such report to the OpenSSL team here. Removing this code has the side effect of crippling the seeding process for the OpenSSL PRNG. Instead of mixing in random data for the initial seed, the only “random” value that was used was the current process ID. On the Linux platform, the default maximum process ID is 32,768, resulting in a very small number of seed values being used for all PRNG operations. The most security focused uh? the distro where a maintainer modifies code he doesn't understand because valgrind complains about it? In one of the most important packages of a linux distribution? No. Anyone who has had memories of this event would treat anything stamped with debian's name as nuclear waste. Debian has had many conflicts with upstream projects for their relentlessly idiotic patching. Firefox once prohibited Debian from using the FF trademarked name and debian in turn renamed firefox "Iceweasel" in their distribution to continue shipping their tainted version. I'd trust any of these : RHEL/Fedora, openSUSE, Gentoo and Arch over debian any day.
  - WastingMyTime89 4y ago
    > The most security focused uh? the distro where a maintainer modifies code he doesn't understand because valgrind complains about it? To be fair, the maintenir had asked about the change on the project mailing list and was given the go ahead. I too don’t like the general attitude of Debian towards patching but it’s an issue of the whole project. There is no need to single out someone.
- WastingMyTime89 4y ago
  By whom? Because I can assure you that it’s not true. Debian patches a lot for completely bonker reasons. They do it to support architectures nobody uses. They do it to remove part of packages for purely ideological motives. They do it to split packages into multiple parts making work harder for upstream when bugs are found. They do it to integrate with their own subpar tools. Sometimes they introduce major bugs along the way like the infamous OpenSSL one. I understand people liking the fact that Debian is community maintained but the security track record is simply not there.
  - bastardoperator 4y ago
    Verizon, GitHub, Godaddy, Cisco, Google, NASA. If you don't like a debian package you can roll your own which is dead simple. I've never worked for a company that is 100% reliant on OS provided packages. Seems like it is true...
    - _-david-_ 4y ago
      Are you sure all those companies use Debian? I thought Verizon and GoDaddy were using CentOS. Also Google's Debian is customized might not really be appropriate to still call it Debian.

candiddevmike 4y ago

What distro do you use?

WastingMyTime89 4y ago
For my personal server? ArchLinux, something I would never use professionally but enjoy on my machine. Packages are mostly vanilla and are updated quickly. The last software company I worked for used CentOS.

goodpoint 4y ago

Debian is well known for being the most stability and security focused among the major distros.

HNDV 4y ago
https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... >On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused by the removal of the following line of code from md_rand.c > MD_Update(&m,buf,j); > [ .. ] > MD_Update(&m,buf,j); /* purify complains */ >These lines were removed because they caused the Valgrind and Purify tools to produce warnings about the use of uninitialized data in any code that was linked to OpenSSL. You can see one such report to the OpenSSL team here. Removing this code has the side effect of crippling the seeding process for the OpenSSL PRNG. Instead of mixing in random data for the initial seed, the only “random” value that was used was the current process ID. On the Linux platform, the default maximum process ID is 32,768, resulting in a very small number of seed values being used for all PRNG operations. The most security focused uh? the distro where a maintainer modifies code he doesn't understand because valgrind complains about it? In one of the most important packages of a linux distribution? No. Anyone who has had memories of this event would treat anything stamped with debian's name as nuclear waste. Debian has had many conflicts with upstream projects for their relentlessly idiotic patching. Firefox once prohibited Debian from using the FF trademarked name and debian in turn renamed firefox "Iceweasel" in their distribution to continue shipping their tainted version. I'd trust any of these : RHEL/Fedora, openSUSE, Gentoo and Arch over debian any day.
- WastingMyTime89 4y ago
  > The most security focused uh? the distro where a maintainer modifies code he doesn't understand because valgrind complains about it? To be fair, the maintenir had asked about the change on the project mailing list and was given the go ahead. I too don’t like the general attitude of Debian towards patching but it’s an issue of the whole project. There is no need to single out someone.
WastingMyTime89 4y ago
By whom? Because I can assure you that it’s not true. Debian patches a lot for completely bonker reasons. They do it to support architectures nobody uses. They do it to remove part of packages for purely ideological motives. They do it to split packages into multiple parts making work harder for upstream when bugs are found. They do it to integrate with their own subpar tools. Sometimes they introduce major bugs along the way like the infamous OpenSSL one. I understand people liking the fact that Debian is community maintained but the security track record is simply not there.
- bastardoperator 4y ago
  Verizon, GitHub, Godaddy, Cisco, Google, NASA. If you don't like a debian package you can roll your own which is dead simple. I've never worked for a company that is 100% reliant on OS provided packages. Seems like it is true...
  - _-david-_ 4y ago
    Are you sure all those companies use Debian? I thought Verizon and GoDaddy were using CentOS. Also Google's Debian is customized might not really be appropriate to still call it Debian.