3 ms·

I might be wrong but I think that's because the fix is directly patched by the ubuntu security team, NOT by the upstream package maintainer. That means they are

I might be wrong but I think that's because the fix is directly patched by the ubuntu security team, NOT by the upstream package maintainer. That means they are providing their own patch, just faster. If the package is updated upstream, you will be able to get the update. Also, ubuntu pro is free for up to 5 users so for most users this is just a free additional feature. There's almost no downside here, at worst you get the updates as quickly as you would in any other distro. They also update packages that do not get upstream support at all anymore, such as python 2.7. Which obviously requires a lot of work directly from Canonical, so I don't really get the reaction in the comments here. This reddit comment explains it way better than I do: >It is a bit more nuanced. These are not fixes by the package maintainer or the community. Those you get regardless of Pro status. >Pro is for patches by the Ubuntu security team. And I understand why they require an opt-in, as not everyone would want their packages patched by Ubuntu (instead of waiting for an official patch from the maintainer). >So basically Ubuntu are giving you a new feature (that you won’t get at other distros, these are patches by Ubuntu themselves) for free if you would like to opt in for it. >They could have communicated it better, but the rage is misplaced in my opinion. https://www.reddit.com/r/Ubuntu/comments/10pqklh/canonical_trying_to_force_me_into_pro/j6m2v1a/ https://www.reddit.com/r/Ubuntu/comments/10pqklh/canonical_t...

jacooper 4y ago
Doesn't redhat do the same thing? They back port security patches to older unsupporteded versions? If that's true, it means RHELs and RHEL clones have better security coverage. Edit: No they don't, these security updates are for Ubuntu universe, which is basically ubuntus version of rpmfusion.
whoisthemachine 4y ago
Is it known if they submit the patches upstream? If not, that seems borderline unethical to do so with security patches.
- mardifoufs 4y ago
  That's a good question! I have no clue, but I know that they also patch unsupported packages that probably aren't getting updated anymore. I'm not sure how they assess which packages are vulnerable but I guess some of them already have a fix upstream that didn't go through the (debian or ubuntu) repo maintainers yet.
  - mhio 4y ago
    If not, maybe someone can build a "centos-esm" from the sources? At least for the GPL packages where they have to be provided.
donmcronald 4y ago
> There's almost no downside here, at worst you get the updates as quickly as you would in any other distro. There could easily be downside. It's free for 5 machines for now. However, the big risk IMO is if relying on Ubuntu for security patches becomes a normal thing. In fact, it could even go as far as having Ubuntu make deals with software developers to maintain security patches for software past a certain lifecycle (ex: 2-3 years). By doing that, Ubuntu could discourage projects from running their own LTS programs and all of a sudden Ubuntu would become the only viable LTS distro. Open source means nothing. Whoever controls the development effort is the one who decides how open software really is. If Ubuntu manages security patches for all the LTS packages, the only choice of LTS distro is Ubuntu and there's no way on earth they'll keep any kind of significant free offer available if that happens.
- angry_moose 4y ago
  Yeah, the next step is "Sorry, you're only on Pro. This update is only available for Pro++ subscribers or higher". Creeping monetization always plays out the same way. Ease people in, then squeeze them later.
iso1631 4y ago
I haven't looked really closely so maybe I can, but when I've looked in the past, I couldn't start an ubuntu machine on AWS that's a "pro" version, at say 1c/hour ($87/year) or whatever, on top of the x cents an hour I pay amazon for the machine. Instead I have to raise a separate business case about why I want to pay for support, manage a separate line item in my budget, etc, etc, that's all tedious, so I don't bother.
- mardifoufs 4y ago
  You are right, my comment wasn't completely accurate since I forgot to mention that the free ubuntu pro plan is only for personal use or for less than 5 devices. I don't think you can get it working on a cloud instance even if you are eligible for the free plan unless you manually install it on a VM or something.

jacooper 4y ago

Doesn't redhat do the same thing? They back port security patches to older unsupporteded versions? If that's true, it means RHELs and RHEL clones have better security coverage. Edit: No they don't, these security updates are for Ubuntu universe, which is basically ubuntus version of rpmfusion.

whoisthemachine 4y ago

Is it known if they submit the patches upstream? If not, that seems borderline unethical to do so with security patches.

mardifoufs 4y ago
That's a good question! I have no clue, but I know that they also patch unsupported packages that probably aren't getting updated anymore. I'm not sure how they assess which packages are vulnerable but I guess some of them already have a fix upstream that didn't go through the (debian or ubuntu) repo maintainers yet.
- mhio 4y ago
  If not, maybe someone can build a "centos-esm" from the sources? At least for the GPL packages where they have to be provided.

donmcronald 4y ago

> There's almost no downside here, at worst you get the updates as quickly as you would in any other distro. There could easily be downside. It's free for 5 machines for now. However, the big risk IMO is if relying on Ubuntu for security patches becomes a normal thing. In fact, it could even go as far as having Ubuntu make deals with software developers to maintain security patches for software past a certain lifecycle (ex: 2-3 years). By doing that, Ubuntu could discourage projects from running their own LTS programs and all of a sudden Ubuntu would become the only viable LTS distro. Open source means nothing. Whoever controls the development effort is the one who decides how open software really is. If Ubuntu manages security patches for all the LTS packages, the only choice of LTS distro is Ubuntu and there's no way on earth they'll keep any kind of significant free offer available if that happens.

angry_moose 4y ago
Yeah, the next step is "Sorry, you're only on Pro. This update is only available for Pro++ subscribers or higher". Creeping monetization always plays out the same way. Ease people in, then squeeze them later.

iso1631 4y ago

I haven't looked really closely so maybe I can, but when I've looked in the past, I couldn't start an ubuntu machine on AWS that's a "pro" version, at say 1c/hour ($87/year) or whatever, on top of the x cents an hour I pay amazon for the machine. Instead I have to raise a separate business case about why I want to pay for support, manage a separate line item in my budget, etc, etc, that's all tedious, so I don't bother.

mardifoufs 4y ago
You are right, my comment wasn't completely accurate since I forgot to mention that the free ubuntu pro plan is only for personal use or for less than 5 devices. I don't think you can get it working on a cloud instance even if you are eligible for the free plan unless you manually install it on a VM or something.