3 ms·
Has anyone actually done any research on how good the backporting of security fixes is in frozen distros? Maybe it's pretty good for very popular packages, but
by Nextgrid 3y ago
Has anyone actually done any research on how good the backporting of security fixes is in frozen distros?
Maybe it's pretty good for very popular packages, but how about the more niche ones (and when it comes to Debian I'm not sure how popular Caddy is in their view)?
- bravetraveler 3y agoAnecdotally, my experience has been okay... but not great -- you can end up with something Frankenstein would create The versions often feel arbitrary and don't line up. For example... I've been watching this for years: https://bugs.launchpad.net/ubuntu/+source/firewalld/+bug/1835188 https://bugs.launchpad.net/ubuntu/+source/firewalld/+bug/183... This is more on the edge case side of things, too. Not really security patch related -- but a consequence of picking/choosing component levels With this the firewall can randomly just stop being effective When things aren't exactly upstream, the knives you're juggling get a little bigger and more unbalanced.
- e12e 3y agoMostly ok, sometimes terrible: https://wiki.debian.org/SSLkeys#Technical_Summary https://wiki.debian.org/SSLkeys#Technical_Summary