5 ms·

The problem with Debian is their insistence on "stability" by not updating the packages. In the modern world, when software development speed picked up steam qu

by xvilka 3y ago

The problem with Debian is their insistence on "stability" by not updating the packages. In the modern world, when software development speed picked up steam quite a lot, releases of new software happen much more often than distribution life cycles.

mschuster91 3y ago
That's not a problem, that's a feature. If you're on Debian or Ubuntu LTS, you (generally) don't have to worry about something breaking by running `apt upgrade` to keep up with security fixes - only release upgrades can and will give you trouble, but eh, that's to be expected.
- znpy 3y ago
  Yes in theory, mot really in practice. Many times I’ve add to add external/weird repositories to get some functionalities i rrallneeded (eg: appropriate codecs fir bluetooth audio and a version of bluez that supported by bluetooth headsets) and that kind of tainting really endangers the longevity of a debian-based system. I understand that the fault is completely on the external repositories and on the user… however the choice then is to be able to use my hardware (or, in general, to the kind if computing i need) or not. These days I’m using fedora btw, which has been really stable while providing fairly up-to-date packages.
  - fjfuvucucuc 3y ago
    I think if you're finding debian too slow you're probably not valuing stability to the same level. That's not a problem with debian, that's just a mismatch in needs, you're probably better off with a "less" stable operating system.
    - znpy 3y ago
      > That's not a problem with debian, that's just a mismatch in needs, you're probably better off with a "less" stable operating system. I'll be honest, i haven't had any stability issues with Fedora either, and i've been upgrading as often as i would with Debian. And in both cases, i'm using fairly old and known hardware (years old thinkpads, the T440 and the X270).
      - fjfuvucucuc 3y ago
        Ok, and when google starts deploying Gmail to old t440s running fedora I'll tell them the reliability "just as good as debian".
  - ylyn 3y ago
    Then Debian is the wrong distro for you. Debian is for people who want to configure a server once and have it stay running and secure. "Stability" in Debian's context means _version_ stability, not that it doesn't crash. I think most Linux distros aim to not crash.
    - znpy 3y ago
      > Then Debian is the wrong distro for you. Indeed, I moved to Fedora and I haven't looked back. I was already using RHEL and CentOS (later Rocky Linux) on servers, I guess it's bye-bye time for Debian. > Debian is for people who want to configure a server once and have it stay running and secure. The same could be said for RHEL and most of its derivatives though.
- oefrha 3y ago
  Not all software keeps working for eternity without updates. I happen to be the author of a piece of software packaged by Debian that relies on a third party HTTP endpoint that changes semi-frequently, necessitating fixes to keep it working. We also liberally bump the major version number when there are big new features in addition to whatever fixes are necessary. The end result is Debian refuses to update to a working version, and the version in stable is completely broken more often than not. So we had to discourage Debian (and derivatives) users from installing the distro version, and close all issues they open.
  - MichaelZuo 3y ago
    Why haven't the Debian team removed it then? (Assuming they were notified)
    - oefrha 3y ago
      No idea. We talked to the DD about it. Maybe they’re content with the software working in testing and sometimes in stable. Of course in theory they could also try to backport the changes, but I doubt anyone would bother for anything that’s not hugely popular. I’m tired of distro patches generating support load anyway.
      - MichaelZuo 3y ago
        Huh that does sound bizarre. What is your software?
        oefrha 3y ago
        This is a pseudonymous account so I’m won’t disclose the software which will link my identity to it.
        mschuster91 3y ago
        If I were to guess, youtube-dl fits the bill... just like browsers, it has the problem that it needs to update far more frequently than any OS/distro schedule allows.
glimshe 3y ago
That's one of Debian's key value propositions. "In the modern world", updates introduce zero-day vulnerabilities, critical bugs and unproven features. Debian is the rock solid foundation you can always count on.
- alphager 3y ago
  On the flip side, Debian doesn't upgrade to a new version when a vulnerability is found in the shipped version. Instead, they try to backport just the fix. If Debian shipped version n and the upstream fixes the vulnerability in version n+5 (not unusual, as debian stable is routinely out of date for 2-4 years depending on the length of the testing freeze and the point in time of the stable lifecycle), this can range from trivial to near impossible in a timely manner. They also tend to be opinionated about the software they ship and do include many Debian-specific patches. Most of them are harmless or just small changes to make the software work better with the Debian way of configuring things; sometimes much more catastrophic: https://github.com/g0tmi1k/debian-ssh https://github.com/g0tmi1k/debian-ssh
shiomiru 3y ago
Debian stable is best for servers and computers where you don't always need the latest versions of programs but still need security updates. If you're e.g. a desktop computer power-user who does want to use the newest packages, then you may want to look into Debian testing instead.
- deleted 3y ago
  [deleted]
- gettodachoppa 3y ago
  That's what I do on my server. I run Debian stable to keep everything running smoothly. If I want the latest version of a service app, I check for a Docker container and run that. If it's a CLI tool, I'll check for an apt repo, or build it from source then copy it to /usr/local/bin/. I feel like I'm getting the best of both worlds: a rock-solid OS, and with a tiny bit of effort I can run the newest version of any tool I want. By not doing this systematically on every single package in the OS, there's little risk of breakage.
hiq 3y ago
Repeating myself: https://news.ycombinator.com/item?id=37162506 https://news.ycombinator.com/item?id=37162506 In which case was it an actual problem for you? What about switching to testing or unstable? In my case I like to mix stable with a few packages from testing / unstable if needed. The current stable is relatively recent, so right now I just have golang from testing for instance. I agree with the sibling comment that it's more of a feature: it's more efficient for me to work around the bugs / missing features of packages that won't be update for a while and stick to these workarounds, rather than constantly adapt to new bugs (even if old ones are fixed) or to changing features.
curt15 3y ago
>In the modern world, when software development speed picked up steam quite a lot, releases of new software happen much more often than distribution life cycles. It's not just a modern thing. For no other platforms are application versions so tightly coupled with the OS version. Mac or Windows users would tell you to take a hike if you tell them they can't usually get new software without upgrading their OS. Similarly Android apps typically target somewhat older platform API versions to support users who have not yet upgraded to the latest base system.
ransackdev 3y ago
If you add the backports repo you’ll get access to newer packages. https://backports.debian.org/ https://backports.debian.org/
Noughmad 3y ago
As always, it's a tradeoff. Sometimes it's a problem, sometimes the same thing is a critical feature. Which is why it's so important that you have multiple choices. If you need the latest packages, use Arch. If you need stability over multiple years, use Debian.
mike_hock 3y ago
Development speed didn't pick up steam, quality standards dropped or disappeared completely.
jwells89 3y ago
The issue with old packages I run into is that I don’t live in a Debian Linux only bubble — I use Windows and macOS too, which makes major version discrepancies between platforms irritating and occasionally a problem (data format changes, feature differences, etc). For desktop use, distros like Fedora strike a decent balance in my opinion, being much more up to date without sitting on the bleeding edge and usually updating without issue.

by xvilka 3y ago

mschuster91 3y ago

That's not a problem, that's a feature. If you're on Debian or Ubuntu LTS, you (generally) don't have to worry about something breaking by running `apt upgrade` to keep up with security fixes - only release upgrades can and will give you trouble, but eh, that's to be expected.

znpy 3y ago
Yes in theory, mot really in practice. Many times I’ve add to add external/weird repositories to get some functionalities i rrallneeded (eg: appropriate codecs fir bluetooth audio and a version of bluez that supported by bluetooth headsets) and that kind of tainting really endangers the longevity of a debian-based system. I understand that the fault is completely on the external repositories and on the user… however the choice then is to be able to use my hardware (or, in general, to the kind if computing i need) or not. These days I’m using fedora btw, which has been really stable while providing fairly up-to-date packages.
- fjfuvucucuc 3y ago
  I think if you're finding debian too slow you're probably not valuing stability to the same level. That's not a problem with debian, that's just a mismatch in needs, you're probably better off with a "less" stable operating system.
  - znpy 3y ago
    > That's not a problem with debian, that's just a mismatch in needs, you're probably better off with a "less" stable operating system. I'll be honest, i haven't had any stability issues with Fedora either, and i've been upgrading as often as i would with Debian. And in both cases, i'm using fairly old and known hardware (years old thinkpads, the T440 and the X270).
    - fjfuvucucuc 3y ago
      Ok, and when google starts deploying Gmail to old t440s running fedora I'll tell them the reliability "just as good as debian".
- ylyn 3y ago
  Then Debian is the wrong distro for you. Debian is for people who want to configure a server once and have it stay running and secure. "Stability" in Debian's context means _version_ stability, not that it doesn't crash. I think most Linux distros aim to not crash.
  - znpy 3y ago
    > Then Debian is the wrong distro for you. Indeed, I moved to Fedora and I haven't looked back. I was already using RHEL and CentOS (later Rocky Linux) on servers, I guess it's bye-bye time for Debian. > Debian is for people who want to configure a server once and have it stay running and secure. The same could be said for RHEL and most of its derivatives though.
oefrha 3y ago
Not all software keeps working for eternity without updates. I happen to be the author of a piece of software packaged by Debian that relies on a third party HTTP endpoint that changes semi-frequently, necessitating fixes to keep it working. We also liberally bump the major version number when there are big new features in addition to whatever fixes are necessary. The end result is Debian refuses to update to a working version, and the version in stable is completely broken more often than not. So we had to discourage Debian (and derivatives) users from installing the distro version, and close all issues they open.
- MichaelZuo 3y ago
  Why haven't the Debian team removed it then? (Assuming they were notified)
  - oefrha 3y ago
    No idea. We talked to the DD about it. Maybe they’re content with the software working in testing and sometimes in stable. Of course in theory they could also try to backport the changes, but I doubt anyone would bother for anything that’s not hugely popular. I’m tired of distro patches generating support load anyway.
    - MichaelZuo 3y ago
      Huh that does sound bizarre. What is your software?
      - oefrha 3y ago
        This is a pseudonymous account so I’m won’t disclose the software which will link my identity to it.
      - mschuster91 3y ago
        If I were to guess, youtube-dl fits the bill... just like browsers, it has the problem that it needs to update far more frequently than any OS/distro schedule allows.

glimshe 3y ago

That's one of Debian's key value propositions. "In the modern world", updates introduce zero-day vulnerabilities, critical bugs and unproven features. Debian is the rock solid foundation you can always count on.

alphager 3y ago
On the flip side, Debian doesn't upgrade to a new version when a vulnerability is found in the shipped version. Instead, they try to backport just the fix. If Debian shipped version n and the upstream fixes the vulnerability in version n+5 (not unusual, as debian stable is routinely out of date for 2-4 years depending on the length of the testing freeze and the point in time of the stable lifecycle), this can range from trivial to near impossible in a timely manner. They also tend to be opinionated about the software they ship and do include many Debian-specific patches. Most of them are harmless or just small changes to make the software work better with the Debian way of configuring things; sometimes much more catastrophic: https://github.com/g0tmi1k/debian-ssh https://github.com/g0tmi1k/debian-ssh

shiomiru 3y ago

Debian stable is best for servers and computers where you don't always need the latest versions of programs but still need security updates. If you're e.g. a desktop computer power-user who does want to use the newest packages, then you may want to look into Debian testing instead.

deleted 3y ago
[deleted]
gettodachoppa 3y ago
That's what I do on my server. I run Debian stable to keep everything running smoothly. If I want the latest version of a service app, I check for a Docker container and run that. If it's a CLI tool, I'll check for an apt repo, or build it from source then copy it to /usr/local/bin/. I feel like I'm getting the best of both worlds: a rock-solid OS, and with a tiny bit of effort I can run the newest version of any tool I want. By not doing this systematically on every single package in the OS, there's little risk of breakage.

hiq 3y ago

Repeating myself: https://news.ycombinator.com/item?id=37162506 https://news.ycombinator.com/item?id=37162506 In which case was it an actual problem for you? What about switching to testing or unstable? In my case I like to mix stable with a few packages from testing / unstable if needed. The current stable is relatively recent, so right now I just have golang from testing for instance. I agree with the sibling comment that it's more of a feature: it's more efficient for me to work around the bugs / missing features of packages that won't be update for a while and stick to these workarounds, rather than constantly adapt to new bugs (even if old ones are fixed) or to changing features.

curt15 3y ago

>In the modern world, when software development speed picked up steam quite a lot, releases of new software happen much more often than distribution life cycles. It's not just a modern thing. For no other platforms are application versions so tightly coupled with the OS version. Mac or Windows users would tell you to take a hike if you tell them they can't usually get new software without upgrading their OS. Similarly Android apps typically target somewhat older platform API versions to support users who have not yet upgraded to the latest base system.

ransackdev 3y ago

If you add the backports repo you’ll get access to newer packages. https://backports.debian.org/ https://backports.debian.org/

Noughmad 3y ago

As always, it's a tradeoff. Sometimes it's a problem, sometimes the same thing is a critical feature. Which is why it's so important that you have multiple choices. If you need the latest packages, use Arch. If you need stability over multiple years, use Debian.

mike_hock 3y ago

Development speed didn't pick up steam, quality standards dropped or disappeared completely.

jwells89 3y ago

The issue with old packages I run into is that I don’t live in a Debian Linux only bubble — I use Windows and macOS too, which makes major version discrepancies between platforms irritating and occasionally a problem (data format changes, feature differences, etc). For desktop use, distros like Fedora strike a decent balance in my opinion, being much more up to date without sitting on the bleeding edge and usually updating without issue.