4 ms·

...imagine fixing a bug, but 2 years later, the distribution isn’t shipping your update... This grossly misstates the concept of a stable distribution (e.g., D

...imagine fixing a bug, but 2 years later, the distribution isn’t shipping your update... This grossly misstates the concept of a stable distribution (e.g., Debian stable, with which I'm most familiar). Debian stable isn't "stable" in that packages don't change, to the point that updates aren't applied at all, it's stable in that functionality and interfaces are stable. The user experience (modulo bugs and security fixes) does not change. Stable does receive updates that address bugs and security issues. What Stable does not do is radically revise programs, applications, and libraries. Though it's more nuanced than that even: stable provides several options for tracking rapidly-evolving software, the most notorious and significant of which are Web browsers with the major contenders updating quite frequently (quarterly or monthly, for example, for Google Chrome "stable" and "dev" respectively). That's expanded further with Flatpack, k8s, and other options, in recent years. The catch is that updates require package maintainers to work on integrating and backporting fixes to code. More prominent and widely-used packages do this. The issue of old bugs being reported to upstream ... is a breakage of the system in several ways: distro's bug-tracking systems (BTSes) should catch (and be used by) their users, upstream BTSes arguably should reject tickets opened on older (and backported) versions. The solutions are neither purely technical nor social, which makes solutions challenging. But in reality we should admit that: - Upstream developers don't like dealing with the noise of stale bugs. - Users are going to rant to upstream regardless of distro-level alternatives. - Upstreams' BTSes should anticipate this and automate redirection of bugs to the appropriate channel with as little dev intervention as possible. Preferably none. - Distros should increase awareness and availability of their own BTS systems to address bugs specific to the context of that distro. - Distro maintainers should be diligent about being aware of and backporting fixes and only fixes. - Distros should increase awareness and availability of alternatives for running newer versions of software which aren't in the distro's own stable repos. Widespread distance technological education is a tough nut regardless, there will be failings. The key is that to the extent possible those shouldn't fall on upstream devs. Though part of that responsibility, and awareness of the overall problem, does fall on those upstream devs.

dredmorbius 2y ago
And just to provide some references so you don't have to take my word for it, from the Debian FAQ: "2.2. Are there package upgrades in "stable"?" Generally speaking, no new functionality is added to the stable release. Once a Debian version is released and tagged "stable" most packages will only get security updates.... there are some cases in which packages will be updated in stable ... When an urgent update is required to ensure the software continues working. The package is a data package and the data must be updated in a timely manner. The package needs to be current to useful to end user (e.g. some security software, such as anti-malware products).... And: Users that wish to run updated versions of the software in stable have the option to use "backports". Backports are recompiled packages from testing (mostly) and unstable (in a few cases only, e.g. security updates), so they will run without new libraries (wherever it is possible) on a stable Debian distribution. Debian is strict in interpreting security updates: Security updates serve one purpose: to supply a fix for a security vulnerability. They are not a method for sneaking additional changes into the stable release without going through normal point release procedure. <https://www.debian.org/doc/manuals/debian-faq/getting-debian.en.html#updatestable https://www.debian.org/doc/manuals/debian-faq/getting-debian...>
- Dylan16807 2y ago
  Your first comment says "Stable does receive updates that address bugs and security issues." But your quote about stable says "most packages will only get security updates". So assuming their bug fix isn't security-relevant, it sounds like their original complaint is valid? I don't see how it's "grossly misstating" how stable works. Backports are useful but the default is that the user is on the buggy stable version.
  - dredmorbius 2y ago
    In practice, Debian stable gets bugfixes. I included (and quoted) the Debian FAQ on this matter largely so that I wasn't simply arguing by assertion. See for example the Debian 12.10 release notes. This is an update to the Debian Stable v.12 release: The Debian project is pleased to announce the tenth update of its stable distribution Debian 12 (codename "bookworm"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. <https://www.debian.org/News/2025/20250315.en.html https://www.debian.org/News/2025/20250315.en.html> Strong emphasis on "mainly adds corrections", but "along with a few adjustments for serious problems." That is, in practice, Debian stable receives both security and bugfix updates. You and other readers are strongly encouraged to look through Debian sources (release notes, Policy, Constitution, and individual package updates within stable repos) to verify other questions before posting further concerns here.

dredmorbius 2y ago

And just to provide some references so you don't have to take my word for it, from the Debian FAQ: "2.2. Are there package upgrades in "stable"?" Generally speaking, no new functionality is added to the stable release. Once a Debian version is released and tagged "stable" most packages will only get security updates.... there are some cases in which packages will be updated in stable ... When an urgent update is required to ensure the software continues working. The package is a data package and the data must be updated in a timely manner. The package needs to be current to useful to end user (e.g. some security software, such as anti-malware products).... And: Users that wish to run updated versions of the software in stable have the option to use "backports". Backports are recompiled packages from testing (mostly) and unstable (in a few cases only, e.g. security updates), so they will run without new libraries (wherever it is possible) on a stable Debian distribution. Debian is strict in interpreting security updates: Security updates serve one purpose: to supply a fix for a security vulnerability. They are not a method for sneaking additional changes into the stable release without going through normal point release procedure. <https://www.debian.org/doc/manuals/debian-faq/getting-debian.en.html#updatestable https://www.debian.org/doc/manuals/debian-faq/getting-debian...>

Dylan16807 2y ago
Your first comment says "Stable does receive updates that address bugs and security issues." But your quote about stable says "most packages will only get security updates". So assuming their bug fix isn't security-relevant, it sounds like their original complaint is valid? I don't see how it's "grossly misstating" how stable works. Backports are useful but the default is that the user is on the buggy stable version.
- dredmorbius 2y ago
  In practice, Debian stable gets bugfixes. I included (and quoted) the Debian FAQ on this matter largely so that I wasn't simply arguing by assertion. See for example the Debian 12.10 release notes. This is an update to the Debian Stable v.12 release: The Debian project is pleased to announce the tenth update of its stable distribution Debian 12 (codename "bookworm"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. <https://www.debian.org/News/2025/20250315.en.html https://www.debian.org/News/2025/20250315.en.html> Strong emphasis on "mainly adds corrections", but "along with a few adjustments for serious problems." That is, in practice, Debian stable receives both security and bugfix updates. You and other readers are strongly encouraged to look through Debian sources (release notes, Policy, Constitution, and individual package updates within stable repos) to verify other questions before posting further concerns here.