4 ms·
Can confirm this is a very real problem with a long history. Quoting from a sort of Arch-specific security hardening page[1]: > A common misconception about th
by 77AA777 4y ago
Can confirm this is a very real problem with a long history. Quoting from a sort of Arch-specific security hardening page[1]:
> A common misconception about the Linux kernel is that it's secure, or that users can go a long time without worrying about security updates. Neither of these are even remotely true. New versions of Linux are released almost every week, often containing important security fixes among the other changes. These releases typically don't make explicit mention of which commits have security implications. As a result, many "stable" or "LTS" distributions don't know which commits should be backported to their old kernels, or even that something needs backporting at all. If the problem has a CVE assigned to it, maybe your distribution will pick it up. Maybe not. Even if a CVE exists, at least in the case of Ubuntu and Debian especially, users are often left with kernels full of known holes for months at a time. Red Hat and similar "enterprise" distros have the same problem and have been called out publicly about it on more than one occasion. Moreover, the Linux kernel security team doesn't request CVEs for any vulnerabilities, partly because there are just too many to track. Downstream's culture of trying to cherrypick security fixes in the name of stability does not work. Arch doesn't play the backporting game, instead opting to provide the newest stable kernels shortly after their upstream release.
[1]: https://vez.mrsk.me/linux-hardening.html https://vez.mrsk.me/linux-hardening.html (lots of linked sources in the actual paragraph there)
- deafpolygon 4y agoThis is one reason why I don't mainline a Linux desktop anymore. It's just too much sysadmin work to stay on top of it, in addition to all of the desktop issues. When even the creator of the Linux kernel has a very lax approach to security, and so the culture of Linux is the same way - I consider it an issue.
- aaomidi 4y agoIs there any real reason you don’t auto update everything, especially the kernel as a desktop user? This is one of the nice things about arch I guess. Super simple to run mainline.
- deafpolygon 4y agoExperience has taught me not to be the first to beta-test a new package update, and don't blindly update. I used to run Arch and have run into scenarios multiple times where I've been unable to boot into a desktop environment because of an update. They were recoverable issues, but still cost me time and motivation for that day. That, and updates are just a constant stream - there is always a new package to update every single day. And as a separate issue, but the quality of software has taken a sharp decline lately as we all start switching to flatpaks and snaps (a correlation, not causative). More and more software is Electron-based and the quality of the non-Electron based software has more or less tanked. Not many hobby programmers are making desktop software anymore.
- est31 4y agoYou could try using Nix OS stable with "boot.kernelPackages = pkgs.linuxPackages_latest;". That way, you will get the latest kernel version and if there is an issue with you being unable to boot into a desktop environment, you can very easily roll back the update by rebooting and selecting an older generation in the boot manager's menu.
- _0w8t 4y agoI second that. On few occasions kernel update in Fedora on my Dell XPS from 2016 cannot boot. The last time it was an upstream regression that was not fixed for months. In the mean time a bad WiFi bug was discovered. I could in theory compiled my own kernel with a fix but without the boot regression, but I rather decided to use Debian. At least they do backport fixes
- kevin_thibedeau 4y agoNothing prevents you from running the latest kernel. The kernel build scripts can even generate .deb and .rpm directly so it coexists nicely with the package manager, though even that isn't strictly necessary.
- aaomidi 4y agoOther than the constant restarts necessary. It’s not that but it does get old fast.
- calvinmorrison 4y agokpatch has been around for like a decade from Red Hat, I think suse has something similar, ubuntu has a Livepatch service.
- msh 4y agoWho cares about a few reboots? You can reboot a workstation overnight and if you have a single point of failure in your production system the reboot ain't the problem.
- yjftsjthsd-h 4y ago> You can reboot a workstation overnight That depends entirely on how well your state serializes to disk and restores. If nothing else, I occasionally make the mistake of getting a setup going that would just be a pain to recreate in terms of getting everything open again (too many windows open in a specific arrangement).
- hollerith 4y agoNothing prevents you from running the latest kernel, but the project is introducing new bugs with security implications all the time even as it is eradicating old bugs, which is why one guide recommends an LTS kernel as the better of two bad options (the other option's being a stable kernel): https://madaidans-insecurities.github.io/guides/linux-hardening.html#stable-vs-lts https://madaidans-insecurities.github.io/guides/linux-harden...