10 ms·

The following security updates require Ubuntu Pro with ‘esm-apps’ enabled

127 points by dmitrygr 4y ago

jacooper 4y ago
Ubuntu pro is great It gives you all of this for free: - kernel livepatching - support for Ubuntu universe, which even RHEL doesn't match(they don't offer any kind of support for RPMFUSION)، they even offer support for complete projects like WordPress and redis and on. - 10 years of support - faster patches - 5 free production instances My only gripe is that Livepatching seems to restart userspace every time it checks for updates, which breaks rootless docker. Since the free version offers no support, you practically have no place to ask questions about Livepatch, as the Ubuntu forum and askubuntu don't allow it or anything related to Ubuntu Pro. That's without mentioning snaps and the crazy advertising, but it's still pretty good.
josephcsible 4y ago
To summarize: * You're running a version of Ubuntu that's still supported. * One of the packages installed on your system has a known security vulnerability. * There's an updated version of the package available that fixes the vulnerability. * Since you're not subscribed to Ubuntu Pro, you're not allowed to update to the fixed version.
- nubinetwork 4y ago
  If it wasn't bad enough that users are being used as guinea pigs with their staged apt updates model... this really takes the cake.
- ergonaught 4y ago
  You missed * There's an app in the Universe repository, which consists of software that is not formally supported by Canonical at all, which has security updates that are actually available from Canonical if you're an Ubuntu Pro subscriber.
  - willtemperley 4y ago
    So do Canonical get there hands dirty at all and fix any code, or is this straight-up gatekeeping?
    - Aflynn50 4y ago
      This is Canonical getting their hands dirty and applying their own patches faster than the package maintainers. If the package maintainer release a patch then that is applied like normal, no Ubuntu Pro required.
  - cma 4y ago
    I thought it is formally supported by Canonical, just not without Pro. They said it used to be best effort but with Pro it has an SLA right?
  - jeroenhd 4y ago
    Does this mean you do get support for these packages if you pay? Or are they still best effort?
    - jacooper 4y ago
      They actively patch them, which is something even RHEL doesn't do(Rpmfusion not supported at all)
- themodelplumber 4y ago
  I saw where one person had this experience: * It's barely an issue: I registered with Ubuntu online and got a free lifetime license for 5 machines, so it's no biggie. I tried the same and got a minimum quote of $25 a year I think? Has anyone figured out where this free option might be?
- unethical_ban 4y ago
  Once again: If they weren't offering this, it wouldn't be patched at all. If they didn't have this, the security would be lower for everyone. They have not taken anything away from anyone here, they have only provided extra services to people who pay. They communicate this poorly, obviously. And it needs to be made clear that they are not withholding community patches, only contributing for a price priority patches to previously community-only packages.
hexis 4y ago
“The mission for Ubuntu is both social and economic. First, we deliver the world’s free software, freely, to everybody on the same terms. Whether you are a student in India or a global bank, you can download and use Ubuntu free of charge.” - https://ubuntu.com/about https://ubuntu.com/about
- deleted 4y ago
  [deleted]
- ChuckNorris89 4y ago
  Basically, "Embrace, Extend, Extinguish" but in Linux flavor. The best part of Linux is this is totally avoidable (less so if you're in a strict corporate environment where Ubuntu is the only option from IT)
- f38zf5vdt 4y ago
  Also Ubuntu: > Subscription Quantity Billing Total > Ubuntu Pro 1 Billed Yearly $500.00 https://ubuntu.com/pro/subscribe https://ubuntu.com/pro/subscribe
  - oriettaxx 4y ago
    and add another 100$ of VAT for an EU customer! it really is a lot
    - dividuum 4y ago
      If you’re a business, VAT doesn’t matter.
      - oriettaxx 4y ago
        not always, unfortunately :(
  - severino 4y ago
    From your link, I can see it's $25/year for a desktop computer, or $150/year with phone a ticket support. Where does those $500 come from? But also, I read here the other day you can get a free Pro subscription for personal use, on up to 5 machines.
MindTooth 4y ago
Not sure I like this push on Pro. Are RHEL derivatives more relevant now?
- sekh60 4y ago
  RHEL and derivatives have long been the standard in the Ops world for their stability. Rocky Linux and Alma linux are the main two community editions, they are both supported by pretty good communities, so it's hard to pick one. Seems Ubuntu was largely popular with devs and the masses due to it's ease of use back in the day. Never understood why more didn't just go with Fedora back then.
  - ibz 4y ago
    Better marketing, I suppose. Many people really think Linux = Ubuntu.
  - vetinari 4y ago
    Fedora, while very nice, goes too fast. Basically as fast, as the non-LTS ubuntu releases. Ubuntu has the LTS option, for Fedora, that LTS option was CentOS and today Rocky/Alma.
    - oriettaxx 4y ago
      what about centos stream?
      - vetinari 4y ago
        If it works for you, why not. Just be aware, that the point releases did have breaking ABI changes, and now they can happen randomly, without waiting for point release. Since I used the old, non-stream centos, the changes left some bitter taste. Enough to prefer alma.
    - TingPing 4y ago
      Fedora is supported for 1 year. Ubuntu non-LTS is supported for 9 months. Subjectively Fedora has a far more robust updater and just higher quality releases in general IME.
Freak_NL 4y ago
Aw man… I'm really not looking forward to getting out of my comfort zone of just running the current Ubuntu LTS on all my machines. Not that I fear other distributions, but I'm just at a loss at figuring out how to get the combination of broadly supported (also by Steam and Proton on my desktop rig), just working out of the box, and minimal fuss. The writing has been on the wall a while though, with snap making some tools borderline unusable until you install a non-snap version.
- ridgered4 4y ago
  FWIW I run Mint which is ubuntu-ish, and Steam and proton don't really give me any trouble.
  - claytonjy 4y ago
    PopOS is in a similar space, if a bit further from Ubuntu than Mint is (still uses apt!), and I've had no issues with Steam there either.
    - Freak_NL 4y ago
      With both Mint and Pop!OS I worry about the consequences of essentially being downstream versions of Ubuntu. I'll see if the Mint maintainers have a view on this; it does seem like a candidate. Pop!OS seems nice, but I never really got the impression that System76 is doing much more than just reskinning Ubuntu. It just doesn't feel like something that will last. Going back upstream is an option of course, i.e., Debian. It seems to have modernized quite a bit since the olden days. At least there are choices. :)
      - rpdillon 4y ago
        > Pop!OS seems nice, but I never really got the impression that System76 is doing much more than just reskinning Ubuntu. It just doesn't feel like something that will last. I think this undersells Pop!_OS a fair bit. They have a FAQ that actually has a heading "Isn’t it just a re-skinned Ubuntu?"[0]: > To call it a re-skinned Ubuntu brushes over all of the features and quality-of-life improvements that Pop! developers work diligently to create. For an in-depth look at the effort and manpower that goes into updating and maintaining Pop!_OS, take a look at our Roadmap documentation and the This Week in Pop! series on Pop!_Planet. Below, you will find a general list of improvements that make Pop!_OS stand out. I think roadmap doc they mention[1] tells the story pretty well. [0]: https://support.system76.com/articles/difference-between-pop-ubuntu/ https://support.system76.com/articles/difference-between-pop... [1]: https://support.system76.com/articles/roadmap/ https://support.system76.com/articles/roadmap/
_joel 4y ago
Stopped using Ubuntu after this snapd malarky. Glad I did.
baggy_trough 4y ago
Ubuntu used to be a nice default distribution, but with the hideous snaps and now apt spamming ads for a $500/box/year subscription for security updates, it's getting pretty ugly.
- donmcronald 4y ago
  > $500/box/year subscription for security updates Wow. I completely missed that was per year. I thought it was a one time purchase and thought that seemed a bit high. MS sells Server Essentials for up to 10 cores for $500 and that includes use on 1 VM as well AFAIK (don't take that as licensing advice).
  - deleted 4y ago
    [deleted]
oauea 4y ago
Paywalling security updates is evil. Goodbye ubuntu.
f38zf5vdt 4y ago
This is greater customer base suicide than the recent Netflix policies. "Pay up or get hacked".
- prmoustache 4y ago
  Sounds better than MS or Apple who do pay and get hacked int that case.
mardifoufs 4y ago
I might be wrong but I think that's because the fix is directly patched by the ubuntu security team, NOT by the upstream package maintainer. That means they are providing their own patch, just faster. If the package is updated upstream, you will be able to get the update. Also, ubuntu pro is free for up to 5 users so for most users this is just a free additional feature. There's almost no downside here, at worst you get the updates as quickly as you would in any other distro. They also update packages that do not get upstream support at all anymore, such as python 2.7. Which obviously requires a lot of work directly from Canonical, so I don't really get the reaction in the comments here. This reddit comment explains it way better than I do: >It is a bit more nuanced. These are not fixes by the package maintainer or the community. Those you get regardless of Pro status. >Pro is for patches by the Ubuntu security team. And I understand why they require an opt-in, as not everyone would want their packages patched by Ubuntu (instead of waiting for an official patch from the maintainer). >So basically Ubuntu are giving you a new feature (that you won’t get at other distros, these are patches by Ubuntu themselves) for free if you would like to opt in for it. >They could have communicated it better, but the rage is misplaced in my opinion. https://www.reddit.com/r/Ubuntu/comments/10pqklh/canonical_trying_to_force_me_into_pro/j6m2v1a/ https://www.reddit.com/r/Ubuntu/comments/10pqklh/canonical_t...
- jacooper 4y ago
  Doesn't redhat do the same thing? They back port security patches to older unsupporteded versions? If that's true, it means RHELs and RHEL clones have better security coverage. Edit: No they don't, these security updates are for Ubuntu universe, which is basically ubuntus version of rpmfusion.
- whoisthemachine 4y ago
  Is it known if they submit the patches upstream? If not, that seems borderline unethical to do so with security patches.
  - mardifoufs 4y ago
    That's a good question! I have no clue, but I know that they also patch unsupported packages that probably aren't getting updated anymore. I'm not sure how they assess which packages are vulnerable but I guess some of them already have a fix upstream that didn't go through the (debian or ubuntu) repo maintainers yet.
therealmarv 4y ago
Can somebody tell me how it was before? Ubuntu Universe packages were also maintained on best-effort on non-paid 5 year official support before? I mean was something taken away or not on the free version?
- TingPing 4y ago
  You are correct, nothing was taken away. It is a different structure than any other distro where: A. Packages just get updates. B. The official repos are entirely supported but smaller. Ubuntu does the weird split of "It is official but we don't support it". And now that they monetized it you are in a situation where its easy to install something, because they offer it, and then later they hold an update hostage.
  - therealmarv 4y ago
    If nothing was taken away (from before Ubuntu Pro) I'm totally cool with it. Thanks for clarification.
whoisthemachine 4y ago
Wow that's quite a shift.
agilob 4y ago
As opposed to majority here, I think this is pretty good thing worth paying for. >Ubuntu pro reduces your average CVE exposure time from 98 days to 1 day. In a The 98 days is still better than on Windows. > In addition, it includes expanded CVE patching, ten years of security maintenance, optional support and operations for the full stack of open-source applications. This is should be really important for anyone who really cares about their privacy and security. Looks like Ubuntu is providing extra support, kind of like on-call for your desktop and server security. Interested what their SLI and SLA are and how confident UbuntuPro is they can maintain it for long. This is definitely better than relying on community based distros that can't release patched Chrome because 2 developers went on holidays.
PabloOsinaga 4y ago
This comes across as bad but it is actually not that bad. Those packages are from the universe repo, which includes ~23,000 packages that historically have been best effort maintained (unlike the main repository with ~2,300 packages that have guaranteed maintenance). Ubuntu continues providing guaranteed maintenance for the main repo for free as it always have. Now they are adding additional maintenance guarantees for 23,000 packages (which is a positive addition IMO), and making that available via Ububntu Pro You can opt to not use Ubuntu Pro and you would continue getting the same guarantees as you were getting from Universe as before (which largely tracks Debian) More details here in the "What's new with the Ubuntu Pro plan" section of https://ubuntu.com/pro https://ubuntu.com/pro
- jacooper 4y ago
  So its basically rpmfusion with security support.
- graton 4y ago
  > More details here in the "What's new with the Ubuntu Pro plan" section of https://ubuntu.com/pro https://ubuntu.com/pro Not sure about how they show things which are in "universe" and therefore unsupported. Packages like: Python, Perl, Go, Docker, and more... If those aren't included in the base OS, that is a bit concerning.
- donmcronald 4y ago
  > This comes across as bad but it is actually not that bad. It's actually pretty bad. If you're running Ubuntu anywhere there's a bit of bureaucracy, like a government or large business, you get backed into a corner. You can never use any of the packages from 'universe' unless you're buying Ubuntu Pro because if you ever get hit with an exploit where there was a patch available, regardless of the circumstances, you'll get crucified. The insurance company, admin staff, ambitious peers, security analysts, etc. will bury you for not patching a known vulnerability. This is the end of Ubuntu's 'universe' repo for businesses that can't afford $500/year/server. It's just that no one has realized it yet.
  - 4y ago
oriettaxx 4y ago
What they wrote is not correct: "Individual users can get a token for up to 5 free machines" since Ubuntu write[1]: "Free for personal use; Anyone can use Ubuntu Pro for free on up to 5 machine " [1] https://ubuntu.com/pro https://ubuntu.com/pro
oriettaxx 4y ago
Note that the license for a server costs 500$/year, whatever the number of CPUs (!) while the same license for an instance in Amazon/aws will be cheaper (and the price vary with instance's size). Anyhow: as somebody already wrote, this will have AWS users move to AWS linux
re9 4y ago
https://news.ycombinator.com/item?id=34580360 https://news.ycombinator.com/item?id=34600863 https://news.ycombinator.com/item?id=34605980 queue the master dang and his ban-hammer to suppress that thread also.
- tarotuser 4y ago
  That's the problem: for those of us who run Ubuntu and related (Xubuntu here), we found out about this by our regular updating, and having apt give that rude message. It's basically a "fuck you pay me" message, with the subtext of "it'd be a shame if someone was to hack that vulnerable program I just gave you"
Animats 4y ago
In 22.04 LTS, the updater shows "Livepatch" in that menu position. Is that the same thing?
- nubinetwork 4y ago
  I believe livepatch is a pro feature, but it's for reboot-less kernel upgrades.
davb 4y ago
Aggressively pushed snaps. Apt and MOTD ads. And now this. Look, I get it, no-one is entitled to free labour. But OSS runs on goodwill. Canonical profited obscenely from the rich open source community and diverse set of packages. And that’s OK - it’s the nature of open source. They get to differentiate with their orchestration tools and premium support. But the expectation is that when it comes to security patches, we all chip in, in the name of collective safety. If you’ve benefited from packages being part of your ecosystem and you patch a vulnerability, you contribute it back
- jzb 4y ago
  "Canonical profited obscenely" I have to challenge that. Their last revenue numbers that I can find (2020) indicate a moderate profit on a headcount of about 500 people. They've grown pretty well, but that's not the same as profited. Canonical targeted the gaps that Red Hat left when it moved from Red Hat Linux -> Fedora / RHEL, and ate up a lot of the Linux market and grew the pie a bit in terms of people using Linux. But Canonical has never been making money hand over fist. Their finances aren't public but AFAIK they've largely been in the red or breaking even. Their 2020 financial statement indicated profit for 2020 but loss in 2019. An interview with TechCrunch last year[1] suggested their revenue was "$175m last year" -- that's a small fraction of Red Hat's revenue and less than SUSE if I'm not mistaken. Note I'm only responding to their push for Ubuntu Pro - if they're also not pushing patches back upstream or playing games like that, that's a different story. But that's not about making them available vs. making them convenient. [1] https://techcrunch.com/2022/04/21/canonical-now-hopes-to-ipo-in-2023/ https://techcrunch.com/2022/04/21/canonical-now-hopes-to-ipo...
  - account42 4y ago
    Having profited from OSS does not mean that the company has profit left over after spending their money on whatever they want. Canonical certainly has had no shortage of frivolous projects that anyone outside could see were doomed long before they were axed, often from inception. Examples that immediately come to mind are Bazaar, Upstart and Mir (the display protocol and required changes in pretty much all applications toolkits, not their now-a-Wayland-compositor).
anonymousiam 4y ago
I've been using Ubuntu (and variants that use the Ubuntu repositories) for years. I'm glad to see this push by Canonical for improved quality/security across the "universe", and I also see it as a reminder that I've been benefiting from their work without compensating them for years. I'm going to sign up for a paid pro account even though the free tier would be enough for me.
tinus_hn 4y ago
How are they going to prevent people from sharing their patches, as the license on most of these packages allows them to do?
- stubish 4y ago
  Why would they want to prevent that?
  - tinus_hn 4y ago
    If they don’t, why would you buy their service?
    - stubish 4y ago
      No delays (lower risk), compliance with various certifications, lower cost. Most people wouldn't buy the service though, which is why for most people it is completely free.
tarotuser 4y ago
The real problem is that Ubuntu is emitting knowingly vulnerable software for free, and then flaunting "if you were part of our pay-group, you'd get the security patches". The ethical thing is to upstream the fixes, or quit transmitting knowingly faulty and vulnerable software.
- scott_w 4y ago
  As explained, this isn’t what they’re doing at all. They’re putting their own patches in, not withholding upstream patches. If all they did was patch upstream, you’d have to wait longer for the fix. I don’t see how that solution is unambiguously better.
  - tarotuser 4y ago
    Im well aware what they're doing, as I submitted this nearly 2 days ago https://news.ycombinator.com/item?id=34605980 https://news.ycombinator.com/item?id=34605980 Charging money isn't explicitly against the GPL, BSD, or similar FLOSS licenses. However, are they doing what's required of them with the licenses they're making changes to? Better yet, are they submitting these fixes to the package maintainers to fix? What would happen if *I* get this Ubuntu Pro Plus Super crap, and download source, diff it, and submit the diff? Better yet, now that Ubuntu has a fiduciary reason to slow down updates/fixes to Universe, are they going to impede package security fixes and updates, as it now hinders their revenue stream? > As explained, this isn’t what they’re doing at all. They’re putting their own patches in, not withholding upstream patches. As explained, Ubuntu is providing knowingly security-vulnerable software, and then as an upcharge offering their own custom fix. There's plenty of ways to handle this, some better and some worse. They chose worse. > If all they did was patch upstream, you’d have to wait longer for the fix. I don’t see how that solution is unambiguously better. Again, they flagged vulnerable software. They could have emitted a message via APT to warn of a security incident with said software. Or they could remove it from the repo until fixed, or hide it behind a flag with apt. They instead chose to keep disseminating it, and then gatekeep their fixes.
    - scott_w 4y ago
oriettaxx 4y ago
If anybody is interested in the figures https://find-and-update.company-information.service.gov.uk/company/06870835 https://find-and-update.company-information.service.gov.uk/c... any reaction from OpenStack ?
voakbasda 4y ago
I think this new policy creates an escalated security threat. Ubuntu is now effectively advertising which packages have security issues. They have painted a clear target on their users, when previously some work would be required to dig up the same list of vulnerabilities. In other words, this new form of advertising seems to actively help those who would do us harm. This effectively makes Pro a protection racket.
- vore 4y ago
  It's not a protection racket at all: you can go apply the patches yourself from upstream. See https://canonical.com/blog/open-source-security-with-ubuntu-pro https://canonical.com/blog/open-source-security-with-ubuntu-.... > Alongside Ubuntu itself, each of these applications is fully security patched for high and critical CVEs for 10 years. This enables organisations to take advantage of a secure and stable open-source ecosystem with none of the usual maintenance burden! No need to worry about scanning, applying, and testing the latest upstream security updates.
JonChesterfield 4y ago
This is kind of fun. I'm looking forward to the story which goes: - forced to use Ubuntu pro by some corporate person - the security update they push is broken nonsense - your machine is compromised as a result, but wouldn't have been when using the non-pro version

127 points by dmitrygr 4y ago

Ubuntu pro is great It gives you all of this for free: - kernel livepatching - support for Ubuntu universe, which even RHEL doesn't match(they don't offer any kind of support for RPMFUSION)، they even offer support for complete projects like WordPress and redis and on. - 10 years of support - faster patches - 5 free production instances My only gripe is that Livepatching seems to restart userspace every time it checks for updates, which breaks rootless docker. Since the free version offers no support, you practically have no place to ask questions about Livepatch, as the Ubuntu forum and askubuntu don't allow it or anything related to Ubuntu Pro. That's without mentioning snaps and the crazy advertising, but it's still pretty good.

josephcsible 4y ago

To summarize: * You're running a version of Ubuntu that's still supported. * One of the packages installed on your system has a known security vulnerability. * There's an updated version of the package available that fixes the vulnerability. * Since you're not subscribed to Ubuntu Pro, you're not allowed to update to the fixed version.

nubinetwork 4y ago
If it wasn't bad enough that users are being used as guinea pigs with their staged apt updates model... this really takes the cake.
ergonaught 4y ago
You missed * There's an app in the Universe repository, which consists of software that is not formally supported by Canonical at all, which has security updates that are actually available from Canonical if you're an Ubuntu Pro subscriber.
- willtemperley 4y ago
  So do Canonical get there hands dirty at all and fix any code, or is this straight-up gatekeeping?
  - Aflynn50 4y ago
    This is Canonical getting their hands dirty and applying their own patches faster than the package maintainers. If the package maintainer release a patch then that is applied like normal, no Ubuntu Pro required.
- cma 4y ago
  I thought it is formally supported by Canonical, just not without Pro. They said it used to be best effort but with Pro it has an SLA right?
- jeroenhd 4y ago
  Does this mean you do get support for these packages if you pay? Or are they still best effort?
  - jacooper 4y ago
    They actively patch them, which is something even RHEL doesn't do(Rpmfusion not supported at all)
themodelplumber 4y ago
I saw where one person had this experience: * It's barely an issue: I registered with Ubuntu online and got a free lifetime license for 5 machines, so it's no biggie. I tried the same and got a minimum quote of $25 a year I think? Has anyone figured out where this free option might be?
unethical_ban 4y ago
Once again: If they weren't offering this, it wouldn't be patched at all. If they didn't have this, the security would be lower for everyone. They have not taken anything away from anyone here, they have only provided extra services to people who pay. They communicate this poorly, obviously. And it needs to be made clear that they are not withholding community patches, only contributing for a price priority patches to previously community-only packages.

hexis 4y ago

“The mission for Ubuntu is both social and economic. First, we deliver the world’s free software, freely, to everybody on the same terms. Whether you are a student in India or a global bank, you can download and use Ubuntu free of charge.” - https://ubuntu.com/about https://ubuntu.com/about

deleted 4y ago
[deleted]
ChuckNorris89 4y ago
Basically, "Embrace, Extend, Extinguish" but in Linux flavor. The best part of Linux is this is totally avoidable (less so if you're in a strict corporate environment where Ubuntu is the only option from IT)
f38zf5vdt 4y ago
Also Ubuntu: > Subscription Quantity Billing Total > Ubuntu Pro 1 Billed Yearly $500.00 https://ubuntu.com/pro/subscribe https://ubuntu.com/pro/subscribe
- oriettaxx 4y ago
  and add another 100$ of VAT for an EU customer! it really is a lot
  - dividuum 4y ago
    If you’re a business, VAT doesn’t matter.
    - oriettaxx 4y ago
      not always, unfortunately :(
- severino 4y ago
  From your link, I can see it's $25/year for a desktop computer, or $150/year with phone a ticket support. Where does those $500 come from? But also, I read here the other day you can get a free Pro subscription for personal use, on up to 5 machines.

MindTooth 4y ago

Not sure I like this push on Pro. Are RHEL derivatives more relevant now?

sekh60 4y ago
RHEL and derivatives have long been the standard in the Ops world for their stability. Rocky Linux and Alma linux are the main two community editions, they are both supported by pretty good communities, so it's hard to pick one. Seems Ubuntu was largely popular with devs and the masses due to it's ease of use back in the day. Never understood why more didn't just go with Fedora back then.
- ibz 4y ago
  Better marketing, I suppose. Many people really think Linux = Ubuntu.
- vetinari 4y ago
  Fedora, while very nice, goes too fast. Basically as fast, as the non-LTS ubuntu releases. Ubuntu has the LTS option, for Fedora, that LTS option was CentOS and today Rocky/Alma.
  - oriettaxx 4y ago
    what about centos stream?
    - vetinari 4y ago
      If it works for you, why not. Just be aware, that the point releases did have breaking ABI changes, and now they can happen randomly, without waiting for point release. Since I used the old, non-stream centos, the changes left some bitter taste. Enough to prefer alma.
  - TingPing 4y ago
    Fedora is supported for 1 year. Ubuntu non-LTS is supported for 9 months. Subjectively Fedora has a far more robust updater and just higher quality releases in general IME.

Freak_NL 4y ago

Aw man… I'm really not looking forward to getting out of my comfort zone of just running the current Ubuntu LTS on all my machines. Not that I fear other distributions, but I'm just at a loss at figuring out how to get the combination of broadly supported (also by Steam and Proton on my desktop rig), just working out of the box, and minimal fuss. The writing has been on the wall a while though, with snap making some tools borderline unusable until you install a non-snap version.

ridgered4 4y ago
FWIW I run Mint which is ubuntu-ish, and Steam and proton don't really give me any trouble.
- claytonjy 4y ago
  PopOS is in a similar space, if a bit further from Ubuntu than Mint is (still uses apt!), and I've had no issues with Steam there either.
  - Freak_NL 4y ago
    With both Mint and Pop!OS I worry about the consequences of essentially being downstream versions of Ubuntu. I'll see if the Mint maintainers have a view on this; it does seem like a candidate. Pop!OS seems nice, but I never really got the impression that System76 is doing much more than just reskinning Ubuntu. It just doesn't feel like something that will last. Going back upstream is an option of course, i.e., Debian. It seems to have modernized quite a bit since the olden days. At least there are choices. :)
    - rpdillon 4y ago
      > Pop!OS seems nice, but I never really got the impression that System76 is doing much more than just reskinning Ubuntu. It just doesn't feel like something that will last. I think this undersells Pop!_OS a fair bit. They have a FAQ that actually has a heading "Isn’t it just a re-skinned Ubuntu?"[0]: > To call it a re-skinned Ubuntu brushes over all of the features and quality-of-life improvements that Pop! developers work diligently to create. For an in-depth look at the effort and manpower that goes into updating and maintaining Pop!_OS, take a look at our Roadmap documentation and the This Week in Pop! series on Pop!_Planet. Below, you will find a general list of improvements that make Pop!_OS stand out. I think roadmap doc they mention[1] tells the story pretty well. [0]: https://support.system76.com/articles/difference-between-pop-ubuntu/ https://support.system76.com/articles/difference-between-pop... [1]: https://support.system76.com/articles/roadmap/ https://support.system76.com/articles/roadmap/

_joel 4y ago

Stopped using Ubuntu after this snapd malarky. Glad I did.

baggy_trough 4y ago

Ubuntu used to be a nice default distribution, but with the hideous snaps and now apt spamming ads for a $500/box/year subscription for security updates, it's getting pretty ugly.

donmcronald 4y ago
> $500/box/year subscription for security updates Wow. I completely missed that was per year. I thought it was a one time purchase and thought that seemed a bit high. MS sells Server Essentials for up to 10 cores for $500 and that includes use on 1 VM as well AFAIK (don't take that as licensing advice).
- deleted 4y ago
  [deleted]

oauea 4y ago

Paywalling security updates is evil. Goodbye ubuntu.

f38zf5vdt 4y ago

This is greater customer base suicide than the recent Netflix policies. "Pay up or get hacked".

prmoustache 4y ago
Sounds better than MS or Apple who do pay and get hacked int that case.

mardifoufs 4y ago

I might be wrong but I think that's because the fix is directly patched by the ubuntu security team, NOT by the upstream package maintainer. That means they are providing their own patch, just faster. If the package is updated upstream, you will be able to get the update. Also, ubuntu pro is free for up to 5 users so for most users this is just a free additional feature. There's almost no downside here, at worst you get the updates as quickly as you would in any other distro. They also update packages that do not get upstream support at all anymore, such as python 2.7. Which obviously requires a lot of work directly from Canonical, so I don't really get the reaction in the comments here. This reddit comment explains it way better than I do: >It is a bit more nuanced. These are not fixes by the package maintainer or the community. Those you get regardless of Pro status. >Pro is for patches by the Ubuntu security team. And I understand why they require an opt-in, as not everyone would want their packages patched by Ubuntu (instead of waiting for an official patch from the maintainer). >So basically Ubuntu are giving you a new feature (that you won’t get at other distros, these are patches by Ubuntu themselves) for free if you would like to opt in for it. >They could have communicated it better, but the rage is misplaced in my opinion. https://www.reddit.com/r/Ubuntu/comments/10pqklh/canonical_trying_to_force_me_into_pro/j6m2v1a/ https://www.reddit.com/r/Ubuntu/comments/10pqklh/canonical_t...

jacooper 4y ago
Doesn't redhat do the same thing? They back port security patches to older unsupporteded versions? If that's true, it means RHELs and RHEL clones have better security coverage. Edit: No they don't, these security updates are for Ubuntu universe, which is basically ubuntus version of rpmfusion.
whoisthemachine 4y ago
Is it known if they submit the patches upstream? If not, that seems borderline unethical to do so with security patches.
- mardifoufs 4y ago
  That's a good question! I have no clue, but I know that they also patch unsupported packages that probably aren't getting updated anymore. I'm not sure how they assess which packages are vulnerable but I guess some of them already have a fix upstream that didn't go through the (debian or ubuntu) repo maintainers yet.

therealmarv 4y ago

Can somebody tell me how it was before? Ubuntu Universe packages were also maintained on best-effort on non-paid 5 year official support before? I mean was something taken away or not on the free version?

TingPing 4y ago
You are correct, nothing was taken away. It is a different structure than any other distro where: A. Packages just get updates. B. The official repos are entirely supported but smaller. Ubuntu does the weird split of "It is official but we don't support it". And now that they monetized it you are in a situation where its easy to install something, because they offer it, and then later they hold an update hostage.
- therealmarv 4y ago
  If nothing was taken away (from before Ubuntu Pro) I'm totally cool with it. Thanks for clarification.

whoisthemachine 4y ago

Wow that's quite a shift.

agilob 4y ago

As opposed to majority here, I think this is pretty good thing worth paying for. >Ubuntu pro reduces your average CVE exposure time from 98 days to 1 day. In a The 98 days is still better than on Windows. > In addition, it includes expanded CVE patching, ten years of security maintenance, optional support and operations for the full stack of open-source applications. This is should be really important for anyone who really cares about their privacy and security. Looks like Ubuntu is providing extra support, kind of like on-call for your desktop and server security. Interested what their SLI and SLA are and how confident UbuntuPro is they can maintain it for long. This is definitely better than relying on community based distros that can't release patched Chrome because 2 developers went on holidays.

PabloOsinaga 4y ago

This comes across as bad but it is actually not that bad. Those packages are from the universe repo, which includes ~23,000 packages that historically have been best effort maintained (unlike the main repository with ~2,300 packages that have guaranteed maintenance). Ubuntu continues providing guaranteed maintenance for the main repo for free as it always have. Now they are adding additional maintenance guarantees for 23,000 packages (which is a positive addition IMO), and making that available via Ububntu Pro You can opt to not use Ubuntu Pro and you would continue getting the same guarantees as you were getting from Universe as before (which largely tracks Debian) More details here in the "What's new with the Ubuntu Pro plan" section of https://ubuntu.com/pro https://ubuntu.com/pro

jacooper 4y ago
So its basically rpmfusion with security support.
graton 4y ago
> More details here in the "What's new with the Ubuntu Pro plan" section of https://ubuntu.com/pro https://ubuntu.com/pro Not sure about how they show things which are in "universe" and therefore unsupported. Packages like: Python, Perl, Go, Docker, and more... If those aren't included in the base OS, that is a bit concerning.
donmcronald 4y ago
> This comes across as bad but it is actually not that bad. It's actually pretty bad. If you're running Ubuntu anywhere there's a bit of bureaucracy, like a government or large business, you get backed into a corner. You can never use any of the packages from 'universe' unless you're buying Ubuntu Pro because if you ever get hit with an exploit where there was a patch available, regardless of the circumstances, you'll get crucified. The insurance company, admin staff, ambitious peers, security analysts, etc. will bury you for not patching a known vulnerability. This is the end of Ubuntu's 'universe' repo for businesses that can't afford $500/year/server. It's just that no one has realized it yet.
- 4y ago

oriettaxx 4y ago

What they wrote is not correct: "Individual users can get a token for up to 5 free machines" since Ubuntu write[1]: "Free for personal use; Anyone can use Ubuntu Pro for free on up to 5 machine " [1] https://ubuntu.com/pro https://ubuntu.com/pro

oriettaxx 4y ago

Note that the license for a server costs 500$/year, whatever the number of CPUs (!) while the same license for an instance in Amazon/aws will be cheaper (and the price vary with instance's size). Anyhow: as somebody already wrote, this will have AWS users move to AWS linux

re9 4y ago

https://news.ycombinator.com/item?id=34580360 https://news.ycombinator.com/item?id=34600863 https://news.ycombinator.com/item?id=34605980 queue the master dang and his ban-hammer to suppress that thread also.

tarotuser 4y ago
That's the problem: for those of us who run Ubuntu and related (Xubuntu here), we found out about this by our regular updating, and having apt give that rude message. It's basically a "fuck you pay me" message, with the subtext of "it'd be a shame if someone was to hack that vulnerable program I just gave you"

Animats 4y ago

In 22.04 LTS, the updater shows "Livepatch" in that menu position. Is that the same thing?

nubinetwork 4y ago
I believe livepatch is a pro feature, but it's for reboot-less kernel upgrades.

davb 4y ago

Aggressively pushed snaps. Apt and MOTD ads. And now this. Look, I get it, no-one is entitled to free labour. But OSS runs on goodwill. Canonical profited obscenely from the rich open source community and diverse set of packages. And that’s OK - it’s the nature of open source. They get to differentiate with their orchestration tools and premium support. But the expectation is that when it comes to security patches, we all chip in, in the name of collective safety. If you’ve benefited from packages being part of your ecosystem and you patch a vulnerability, you contribute it back

jzb 4y ago
"Canonical profited obscenely" I have to challenge that. Their last revenue numbers that I can find (2020) indicate a moderate profit on a headcount of about 500 people. They've grown pretty well, but that's not the same as profited. Canonical targeted the gaps that Red Hat left when it moved from Red Hat Linux -> Fedora / RHEL, and ate up a lot of the Linux market and grew the pie a bit in terms of people using Linux. But Canonical has never been making money hand over fist. Their finances aren't public but AFAIK they've largely been in the red or breaking even. Their 2020 financial statement indicated profit for 2020 but loss in 2019. An interview with TechCrunch last year[1] suggested their revenue was "$175m last year" -- that's a small fraction of Red Hat's revenue and less than SUSE if I'm not mistaken. Note I'm only responding to their push for Ubuntu Pro - if they're also not pushing patches back upstream or playing games like that, that's a different story. But that's not about making them available vs. making them convenient. [1] https://techcrunch.com/2022/04/21/canonical-now-hopes-to-ipo-in-2023/ https://techcrunch.com/2022/04/21/canonical-now-hopes-to-ipo...
- account42 4y ago
  Having profited from OSS does not mean that the company has profit left over after spending their money on whatever they want. Canonical certainly has had no shortage of frivolous projects that anyone outside could see were doomed long before they were axed, often from inception. Examples that immediately come to mind are Bazaar, Upstart and Mir (the display protocol and required changes in pretty much all applications toolkits, not their now-a-Wayland-compositor).

anonymousiam 4y ago

I've been using Ubuntu (and variants that use the Ubuntu repositories) for years. I'm glad to see this push by Canonical for improved quality/security across the "universe", and I also see it as a reminder that I've been benefiting from their work without compensating them for years. I'm going to sign up for a paid pro account even though the free tier would be enough for me.

tinus_hn 4y ago

How are they going to prevent people from sharing their patches, as the license on most of these packages allows them to do?

stubish 4y ago
Why would they want to prevent that?
- tinus_hn 4y ago
  If they don’t, why would you buy their service?
  - stubish 4y ago
    No delays (lower risk), compliance with various certifications, lower cost. Most people wouldn't buy the service though, which is why for most people it is completely free.

tarotuser 4y ago

The real problem is that Ubuntu is emitting knowingly vulnerable software for free, and then flaunting "if you were part of our pay-group, you'd get the security patches". The ethical thing is to upstream the fixes, or quit transmitting knowingly faulty and vulnerable software.

scott_w 4y ago
As explained, this isn’t what they’re doing at all. They’re putting their own patches in, not withholding upstream patches. If all they did was patch upstream, you’d have to wait longer for the fix. I don’t see how that solution is unambiguously better.
- tarotuser 4y ago
  Im well aware what they're doing, as I submitted this nearly 2 days ago https://news.ycombinator.com/item?id=34605980 https://news.ycombinator.com/item?id=34605980 Charging money isn't explicitly against the GPL, BSD, or similar FLOSS licenses. However, are they doing what's required of them with the licenses they're making changes to? Better yet, are they submitting these fixes to the package maintainers to fix? What would happen if *I* get this Ubuntu Pro Plus Super crap, and download source, diff it, and submit the diff? Better yet, now that Ubuntu has a fiduciary reason to slow down updates/fixes to Universe, are they going to impede package security fixes and updates, as it now hinders their revenue stream? > As explained, this isn’t what they’re doing at all. They’re putting their own patches in, not withholding upstream patches. As explained, Ubuntu is providing knowingly security-vulnerable software, and then as an upcharge offering their own custom fix. There's plenty of ways to handle this, some better and some worse. They chose worse. > If all they did was patch upstream, you’d have to wait longer for the fix. I don’t see how that solution is unambiguously better. Again, they flagged vulnerable software. They could have emitted a message via APT to warn of a security incident with said software. Or they could remove it from the repo until fixed, or hide it behind a flag with apt. They instead chose to keep disseminating it, and then gatekeep their fixes.
  - scott_w 4y ago

oriettaxx 4y ago

If anybody is interested in the figures https://find-and-update.company-information.service.gov.uk/company/06870835 https://find-and-update.company-information.service.gov.uk/c... any reaction from OpenStack ?

voakbasda 4y ago

I think this new policy creates an escalated security threat. Ubuntu is now effectively advertising which packages have security issues. They have painted a clear target on their users, when previously some work would be required to dig up the same list of vulnerabilities. In other words, this new form of advertising seems to actively help those who would do us harm. This effectively makes Pro a protection racket.

vore 4y ago
It's not a protection racket at all: you can go apply the patches yourself from upstream. See https://canonical.com/blog/open-source-security-with-ubuntu-pro https://canonical.com/blog/open-source-security-with-ubuntu-.... > Alongside Ubuntu itself, each of these applications is fully security patched for high and critical CVEs for 10 years. This enables organisations to take advantage of a secure and stable open-source ecosystem with none of the usual maintenance burden! No need to worry about scanning, applying, and testing the latest upstream security updates.

JonChesterfield 4y ago

This is kind of fun. I'm looking forward to the story which goes: - forced to use Ubuntu pro by some corporate person - the security update they push is broken nonsense - your machine is compromised as a result, but wouldn't have been when using the non-pro version