4 ms·

> Debian doesn't just ship upstream updates every 30 minutes. This grossly understates the problem. The debian xscreensaver package was years old, and contain

> Debian doesn't just ship upstream updates every 30 minutes. This grossly understates the problem. The debian xscreensaver package was years old, and contained bugs related to screen locking which were an actual security issue. Your comment is in very poor taste.

midtake 2y ago
Debian is the most stable distro for a reason. They don't rebase from upstream every 30 minutes because it is a community project. It is wonderful that volunteers have continued the Debian project for so long. In contrast, Red Hat Enterprise Linux, a distro funded by IBM and countless faceless backers, has recently stopped patching many vulnerabilities, recommending to their users to rely on mitigations instead, despite the availability of upstream patches. Furthermore, the recent vulnerability threatscape is inundated with CVE hunters who are desperate to call the most minor degradation of service a vulnerability. For a community project (and apparently an enterprise-serving megacorporation), this causes patching fatigue.
- robertlagrant 2y ago
  Where is the "every 30 minutes" coming from? You and another commenter have both used this identical phrase.It sounds as though the complaint was not because a patch hadn't been applied after 30 minutes, or even 30 days or 30 weeks. More like 30 months.
  - rincebrain 2y ago
    I said "every 30 minutes" as a piece of hyperbole, in my original comment. I'm not really sure why everyone is focusing on that phrase, though. I think it's pretty clear if you read any of the source material, as said, that that is not an accurate representation of what was going on, and I would have also expected "every 30 minutes" to be a pretty clearly hyperbolic expectation for anyone to process updates after.
    - robertlagrant 2y ago
      > I'm not really sure why everyone is focusing on that phrase, though Is everyone focusing on the phrase? I thought I asked about it, and that's all that's happened. > I would have also expected "every 30 minutes" to be a pretty clearly hyperbolic expectation for anyone to process updates after I couldn't imagine a benign use of hyperbole in timeliness when some expectations of timeliness are silly, and some are sensible. I thought I'd ask, in case there was a good faith reason for it, rather than just assume you're trying to use insinuation to change people's minds.
nindalf 2y ago
People who actually use Debian and similar distros will disagree. In their view there’s nothing wrong with shipping older, patched versions of open sourced software. The license says they can do it! So they grossly understate the problem, make it seem like it’s the person authoring the software at fault or the one who’s being unreasonable. They’re quick to tell you how great the maintainers are, how much effort they put in for free but they don’t share that same love for the author of the package. You know, the person who actually wrote the software. They don’t acknowledge that without the author they’d have no software to begin with, and that providing support to older versions of software is a cost to the author. Not just older, but possibly broken in subtle ways because of the patches applied on top. The author still gets all the blame and all the support requests for changes they didn’t make. To be clear, there’s nothing wrong with wanting to run old, stable software. No one questions that their distro is “the most stable”. That they cannot or will not see the costs of doing so on the author is a shortcoming, but there’s no solving that.
- fragmede 2y ago
  when it's your screensaver, and I can break into your computer using a bug that's been publicized, so every idiot with access to Google knows about it, yes there's something wrong with running old software. that's just my opinion though. btw, where's your office?
  - SSLy 2y ago
    why are you arguing with a person you agree with?
    - fragmede 2y ago
      I don't agree with the sentence > To be clear, there’s nothing wrong with wanting to run old, stable software.
      - SSLy 2y ago
        Ah, alright, I see.
dmurvihill 2y ago
The screen locking bugfix had already been backported to Debian stable on the day it was released.

midtake 2y ago

Debian is the most stable distro for a reason. They don't rebase from upstream every 30 minutes because it is a community project. It is wonderful that volunteers have continued the Debian project for so long. In contrast, Red Hat Enterprise Linux, a distro funded by IBM and countless faceless backers, has recently stopped patching many vulnerabilities, recommending to their users to rely on mitigations instead, despite the availability of upstream patches. Furthermore, the recent vulnerability threatscape is inundated with CVE hunters who are desperate to call the most minor degradation of service a vulnerability. For a community project (and apparently an enterprise-serving megacorporation), this causes patching fatigue.

robertlagrant 2y ago
Where is the "every 30 minutes" coming from? You and another commenter have both used this identical phrase.It sounds as though the complaint was not because a patch hadn't been applied after 30 minutes, or even 30 days or 30 weeks. More like 30 months.
- rincebrain 2y ago
  I said "every 30 minutes" as a piece of hyperbole, in my original comment. I'm not really sure why everyone is focusing on that phrase, though. I think it's pretty clear if you read any of the source material, as said, that that is not an accurate representation of what was going on, and I would have also expected "every 30 minutes" to be a pretty clearly hyperbolic expectation for anyone to process updates after.
  - robertlagrant 2y ago
    > I'm not really sure why everyone is focusing on that phrase, though Is everyone focusing on the phrase? I thought I asked about it, and that's all that's happened. > I would have also expected "every 30 minutes" to be a pretty clearly hyperbolic expectation for anyone to process updates after I couldn't imagine a benign use of hyperbole in timeliness when some expectations of timeliness are silly, and some are sensible. I thought I'd ask, in case there was a good faith reason for it, rather than just assume you're trying to use insinuation to change people's minds.

nindalf 2y ago

People who actually use Debian and similar distros will disagree. In their view there’s nothing wrong with shipping older, patched versions of open sourced software. The license says they can do it! So they grossly understate the problem, make it seem like it’s the person authoring the software at fault or the one who’s being unreasonable. They’re quick to tell you how great the maintainers are, how much effort they put in for free but they don’t share that same love for the author of the package. You know, the person who actually wrote the software. They don’t acknowledge that without the author they’d have no software to begin with, and that providing support to older versions of software is a cost to the author. Not just older, but possibly broken in subtle ways because of the patches applied on top. The author still gets all the blame and all the support requests for changes they didn’t make. To be clear, there’s nothing wrong with wanting to run old, stable software. No one questions that their distro is “the most stable”. That they cannot or will not see the costs of doing so on the author is a shortcoming, but there’s no solving that.

fragmede 2y ago
when it's your screensaver, and I can break into your computer using a bug that's been publicized, so every idiot with access to Google knows about it, yes there's something wrong with running old software. that's just my opinion though. btw, where's your office?
- SSLy 2y ago
  why are you arguing with a person you agree with?
  - fragmede 2y ago
    I don't agree with the sentence > To be clear, there’s nothing wrong with wanting to run old, stable software.
    - SSLy 2y ago
      Ah, alright, I see.

dmurvihill 2y ago

The screen locking bugfix had already been backported to Debian stable on the day it was released.