3 ms·

Ran into this the other week, the problem is vuln scan tools like nessus will flag it as a missing update but if you don't pay for ESM you don't get the patch

by _8j50 3y ago

Ran into this the other week, the problem is vuln scan tools like nessus will flag it as a missing update but if you don't pay for ESM you don't get the patch even on LTS. I wish they didn't use security as a money making tool, this is exactly why I despise Azure. If the only option is to pay, why pay a company that is using security to profit? Just get redhat and get it over with if you have to haggle with corporate purchasing, legal,etc... anyways. When a package is available in any distro's maintained/mainline repo, users should expect security patches will be available as soon as humany possible for that package. If there was a premium repo, I get charging for that. But right now it is any packages and arbitrary CVE's, very upredictable.

bravetraveler 3y ago
This is a rather frustrating distinction on packages. Canonical says: "Here, enjoy these packages in our base repositories" Many of those packages are completely third party/somehow qualify for 'universe', and such, no longer get security updates. Why rebuild/test only a subset for the upsell? They've taken stewardship by offering them at all, in my opinion. On the other hand: Red Hat will support everything they offer during the lifetime of a release. They don't really pick and choose as far as I'm aware. Caveat: EPEL et al They do have a limited lifetime release problem... but at least they support the whole release.
- yjftsjthsd-h 3y ago
  > On the other hand: Red Hat will support everything they offer during the lifetime of a release. They don't really pick and choose as far as I'm aware. Caveat: EPEL et al I mean, that's the distinction; Ubuntu just includes their EPEL equivalent in the default repos. If you leave out EPEL, then RHEL has far less packages (or did last time I was in that ecosystem), because RH does their pick-and-choose at the repo level.
  - bravetraveler 3y ago
    What makes it frustrating is how Canonical handled it. Not offering something at all is far more 'honest' than building it once and never again

by _8j50 3y ago

bravetraveler 3y ago

This is a rather frustrating distinction on packages. Canonical says: "Here, enjoy these packages in our base repositories" Many of those packages are completely third party/somehow qualify for 'universe', and such, no longer get security updates. Why rebuild/test only a subset for the upsell? They've taken stewardship by offering them at all, in my opinion. On the other hand: Red Hat will support everything they offer during the lifetime of a release. They don't really pick and choose as far as I'm aware. Caveat: EPEL et al They do have a limited lifetime release problem... but at least they support the whole release.

yjftsjthsd-h 3y ago
> On the other hand: Red Hat will support everything they offer during the lifetime of a release. They don't really pick and choose as far as I'm aware. Caveat: EPEL et al I mean, that's the distinction; Ubuntu just includes their EPEL equivalent in the default repos. If you leave out EPEL, then RHEL has far less packages (or did last time I was in that ecosystem), because RH does their pick-and-choose at the repo level.
- bravetraveler 3y ago
  What makes it frustrating is how Canonical handled it. Not offering something at all is far more 'honest' than building it once and never again