4 ms·

Universe packages are not supported by Ubuntu unless you activate Ubuntu Pro. Thus, if you install ffmpeg on Ubuntu without Pro, it will contain several active

by svc0 3y ago

Universe packages are not supported by Ubuntu unless you activate Ubuntu Pro. Thus, if you install ffmpeg on Ubuntu without Pro, it will contain several active vulnerabilities. The full five years only applies packages in the main repo.

isaacremuant 3y ago
That's absolutely terrible and not clear at all. I've been tempted to go back to Arch and I think this can be a good motivator.
- svc0 3y ago
  Just to be clear, on Arch ffmpeg is outdated (6.0 vs 6.1.) This means it has three security vulnerabilities.
  - panarky 3y ago
    Debian's ffmpeg is at 6.1, no subscription nonsense required.
  - viraptor 3y ago
    It's not the case for this example of ffmpeg (it's actually not patched), but make sure to check the actual changelog. Sometimes the version is kept, but the patches are backported, so a plain version comparison is not enough.
- diffeomorphism 3y ago
  That is also absolutely unchanged compared to "since forever". Canonical supports "main", while "universe" and "multiverse" offer best-effort community support (aka from debian). They now additionally offer a dedicated team for those repos. Honest question, since the arch wiki seems surprisingly spotty on this: Which arch repos are covered by their security team? Just core? Or also extra? More than that? AUR surely not, right?
  - guappa 3y ago
    Not even "from debian". Sometimes they can't be bothered to copy debian packages that fix security issues if the package is in universe, and just leave it vulnerable for the entire duration of the LTS. Happened to me.
charcircuit 3y ago
Universe is supported on a "best effort" basis. https://ubuntu.com/security/esm https://ubuntu.com/security/esm
xinayder 3y ago
I wanted to find another reason to not use Ubuntu for servers (besides Snap being forced on everyone) and this was it. At least, in Debian, most of the packages I use on my server are from their main repos. Occasionally there are a few from other sources but by the time a new Debian patch is released, those other packages are also updated.

by svc0 3y ago

isaacremuant 3y ago

That's absolutely terrible and not clear at all. I've been tempted to go back to Arch and I think this can be a good motivator.

svc0 3y ago
Just to be clear, on Arch ffmpeg is outdated (6.0 vs 6.1.) This means it has three security vulnerabilities.
- panarky 3y ago
  Debian's ffmpeg is at 6.1, no subscription nonsense required.
- viraptor 3y ago
  It's not the case for this example of ffmpeg (it's actually not patched), but make sure to check the actual changelog. Sometimes the version is kept, but the patches are backported, so a plain version comparison is not enough.
diffeomorphism 3y ago
That is also absolutely unchanged compared to "since forever". Canonical supports "main", while "universe" and "multiverse" offer best-effort community support (aka from debian). They now additionally offer a dedicated team for those repos. Honest question, since the arch wiki seems surprisingly spotty on this: Which arch repos are covered by their security team? Just core? Or also extra? More than that? AUR surely not, right?
- guappa 3y ago
  Not even "from debian". Sometimes they can't be bothered to copy debian packages that fix security issues if the package is in universe, and just leave it vulnerable for the entire duration of the LTS. Happened to me.

charcircuit 3y ago

Universe is supported on a "best effort" basis. https://ubuntu.com/security/esm https://ubuntu.com/security/esm

xinayder 3y ago

I wanted to find another reason to not use Ubuntu for servers (besides Snap being forced on everyone) and this was it. At least, in Debian, most of the packages I use on my server are from their main repos. Occasionally there are a few from other sources but by the time a new Debian patch is released, those other packages are also updated.