3 ms·

> It made it to production, for a long time Did it? At least in Debian, where it was found in the first place, it only existed in sid/unstable and I think perh

> It made it to production, for a long time Did it? At least in Debian, where it was found in the first place, it only existed in sid/unstable and I think perhaps in testing. It never made it into stable which is the only thing you should be running on a production system. I think in Fedora it was also only in a testing or RC of the next stable version but I'm not sure. Also unsure about others. I have seen several distros putting out advisories (Gentoo, Arch, OpenSuse and more) but I didn't go into the specifics.

stavros 3y ago
I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.
- spacemanspiff01 3y ago
  My impression is that it did not get into latest Ubuntu, they were in the process of trying though. The end goal seems to have been to get it into the LTS releases of rhel and Ubuntu. Since this was a valuable it's probably something kept around for when other methods fail. I doubt it would be used before the really valuable systems are compromised (rhel and Ubuntu in cloud and governments)
- mikeocool 3y ago
  Fortunately, it didn’t make it into an Ubuntu release: https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714 https://discourse.ubuntu.com/t/xz-liblzma-security-update/43... Though it was frighteningly close, 24.04 is scheduled to be released on April 25.
  - stavros 3y ago
    Wow, ok, that's close. I wonder how many have actually made it.
- cassianoleal 3y ago
  I don't personally know anyone who would run any Debian release that's not stable on production systems. On your desktop? Fine. I do it myself. On a server, with ports open to the public Internet that's a big nope. There's nothing wrong with Debian stable having years-old packages either. In any case: > The current "stable" distribution of Debian is version 12, codenamed bookworm. It was initially released as version 12.0 on June 10th, 2023 and its latest update, version 12.5, was released on February 10th, 2024. https://www.debian.org/releases/ https://www.debian.org/releases/ That's just over 1 year. Sure, packages themselves will be older than that since they take some time soaking frozen in testing before they become part of stable but that's generally a good thing. In any case, if there's pressing need for some newer packages, it's always possible to use apt pinning to pull those on top of a stable base.
  - stavros 3y ago
    I didn't say there's anything wrong, I meant that choosing the OS distribution with the oldest packages isn't an indication for how widespread the distribution of this package was.
    - cassianoleal 3y ago
      I was initially responding to > > It made it to production, for a long time I never said it didn't make it to production. I was asking if that's the case, and giving one data point. It apparently didn't make it into Ubuntu LTS either, so there's another one. If you have information that proves or disproves either point, please present it.

stavros 3y ago

I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.

spacemanspiff01 3y ago
My impression is that it did not get into latest Ubuntu, they were in the process of trying though. The end goal seems to have been to get it into the LTS releases of rhel and Ubuntu. Since this was a valuable it's probably something kept around for when other methods fail. I doubt it would be used before the really valuable systems are compromised (rhel and Ubuntu in cloud and governments)
mikeocool 3y ago
Fortunately, it didn’t make it into an Ubuntu release: https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714 https://discourse.ubuntu.com/t/xz-liblzma-security-update/43... Though it was frighteningly close, 24.04 is scheduled to be released on April 25.
- stavros 3y ago
  Wow, ok, that's close. I wonder how many have actually made it.
cassianoleal 3y ago
I don't personally know anyone who would run any Debian release that's not stable on production systems. On your desktop? Fine. I do it myself. On a server, with ports open to the public Internet that's a big nope. There's nothing wrong with Debian stable having years-old packages either. In any case: > The current "stable" distribution of Debian is version 12, codenamed bookworm. It was initially released as version 12.0 on June 10th, 2023 and its latest update, version 12.5, was released on February 10th, 2024. https://www.debian.org/releases/ https://www.debian.org/releases/ That's just over 1 year. Sure, packages themselves will be older than that since they take some time soaking frozen in testing before they become part of stable but that's generally a good thing. In any case, if there's pressing need for some newer packages, it's always possible to use apt pinning to pull those on top of a stable base.
- stavros 3y ago
  I didn't say there's anything wrong, I meant that choosing the OS distribution with the oldest packages isn't an indication for how widespread the distribution of this package was.
  - cassianoleal 3y ago
    I was initially responding to > > It made it to production, for a long time I never said it didn't make it to production. I was asking if that's the case, and giving one data point. It apparently didn't make it into Ubuntu LTS either, so there's another one. If you have information that proves or disproves either point, please present it.