4 ms·

Major advantage of Fedora is being closer to the upstream sources, both in terms of freshness and in terms of not meddling with libs or similar. Debian patches

Major advantage of Fedora is being closer to the upstream sources, both in terms of freshness and in terms of not meddling with libs or similar. Debian patches lead to several possible exploits over the last few years.

yjftsjthsd-h 2y ago
> Debian patches lead to several possible exploits over the last few years. Which ones? There was the OpenSSL entropy bug, of course, but that was 1. in 2006, and 2. run by upstream so feels a bit unfair.
- Yasuraka 2y ago
  I have to admit that I never compiled a list of this type and it seems exceedingly difficult to find useful search results. I couldn't dig up the examples I had in mind from the last 2 years, but stumbled upon others I didn't know of yet in turn, e.g. RCE via Redis, no special config required: > This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rc...
gggmaster 2y ago
Fedora removes elliptic curve algorithms from the source code level [1] and disables hardware acceleration for H.264 / H.265 [2]. [1] https://bugzilla.redhat.com/show_bug.cgi?id=615372 https://bugzilla.redhat.com/show_bug.cgi?id=615372 [2] https://www.phoronix.com/news/Fedora-Disable-Bad-VA-API https://www.phoronix.com/news/Fedora-Disable-Bad-VA-API
- Yasuraka 2y ago
  Yes, distributing non-free, patented code that requires a license, requires a license. The same goes for Debian actually[1], including blocking requests and removing packages that were included before by mistake. I would even dare say that this is another point for Fedora, enabling https://rpmfusion.org/ https://rpmfusion.org/ is a one-liner and feels entirely native, never a broken package. [1] https://www.debian.org/legal/patent https://www.debian.org/legal/patent
  - gggmaster 2y ago
    RPM Fusion does not give me uncrippled crypto libraries. It’s caused by their paranoia about export restrictions, not patents.

yjftsjthsd-h 2y ago

> Debian patches lead to several possible exploits over the last few years. Which ones? There was the OpenSSL entropy bug, of course, but that was 1. in 2006, and 2. run by upstream so feels a bit unfair.

Yasuraka 2y ago
I have to admit that I never compiled a list of this type and it seems exceedingly difficult to find useful search results. I couldn't dig up the examples I had in mind from the last 2 years, but stumbled upon others I didn't know of yet in turn, e.g. RCE via Redis, no special config required: > This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rc...

gggmaster 2y ago

Fedora removes elliptic curve algorithms from the source code level [1] and disables hardware acceleration for H.264 / H.265 [2]. [1] https://bugzilla.redhat.com/show_bug.cgi?id=615372 https://bugzilla.redhat.com/show_bug.cgi?id=615372 [2] https://www.phoronix.com/news/Fedora-Disable-Bad-VA-API https://www.phoronix.com/news/Fedora-Disable-Bad-VA-API

Yasuraka 2y ago
Yes, distributing non-free, patented code that requires a license, requires a license. The same goes for Debian actually[1], including blocking requests and removing packages that were included before by mistake. I would even dare say that this is another point for Fedora, enabling https://rpmfusion.org/ https://rpmfusion.org/ is a one-liner and feels entirely native, never a broken package. [1] https://www.debian.org/legal/patent https://www.debian.org/legal/patent
- gggmaster 2y ago
  RPM Fusion does not give me uncrippled crypto libraries. It’s caused by their paranoia about export restrictions, not patents.