Conversation

The Linux distro model is antithetical to security on a desktop system. It's security anti-vax where you get old, hacked-up software, because package maintainers insist on doing the equivalent of "their own research" instead of just promptly shipping upstream security fixes.

GIF

read image description

ALT

Replying to

but that's only if you assume it's about security, right? if you're coming at it from a stability perspective, it might be pretty sensible. if upstream makes a breaking change, and it's your responsibility that old software keeps working with zero churn for the user...

Replying to

and

This results in a lot more pain for the user in the long term since they need to deal with a massive amount of breaking changes across a bunch of software at the same time when all of them jump many versions ahead together. Good luck figuring out source of regressions, etc.

Replying to

and

I find that it's dramatically less work to use a distribution following along with the latest stable releases without applying any substantial changes to the software. I use the current upstream LTS branch for Linux kernel, nginx, etc. It's far more work to try delaying change.

Replying to

and

On a distribution like Debian, the whole base OS consists of their messed up frankenstein packages with ancient frozen base code, a small subset of security fixes backported and a whole bunch of their misguided changes and weird configuration/scripting frameworks wrapping it.

Replying to

and

It's a massive pain dealing with all their weird automatic scripting and meta-configuration. You have all these weird bugs / problems they've introduced, can't rely on upstream documentation, can't report bugs upstream, can't get fixes from upstream, etc. It's pretty terrible.

Replying to

and

In practice, people use a whole bunch of third party packages. Still built with outdated dependencies, outdated toolchain, etc. but at least you can get an up-to-date version of the application without a whole bunch of ancient bugs including security bugs that didn't get a CVE.

11:52 PM · Oct 7, 2021Twitter Web App

Replying to

and

Package management tools of Debian used to be ahead of most few decades ago, but large part of the structure stagnated after a while. While some of the tools are rather nice in isolation, compatibility problems happen quite frequently when mixing packages from multiple sources.

Leonard/Janis Robert König

Replying to

and

The solution is tricky though, the Windows model sucks as well, but with contained apps we also have the problem of old, unfixed & outdated dependencies being shipped.