Slashdot Mirror


Updates From Debian

A couple of people noted that "Linuxlookup.com is reporting the third update of Debian GNU/Linux 3.0 (codename `woody') which mainly adds security updates to the stable release, along with a few corrections to serious problems. Those who frequently update from security.debian.org won't have to update many packages and most updates from security.debian.org are included in this update." Another reader writes "Looks like the Debian project just released their old stable distribution (woody) with a huge numbers of security updates, some removals and some less critical bugfixes. It's been a long time that we had to wait for it, the last update was in November last year, together with the break-in." And finally: pkarlos_76 writes "What's holding up Debian Sarge from release to stable? It's those lazy maintainers..... no actually it's just a few issues with security and bugs being quashed, and maybe you can help speed things up, especially if you are a maintainer, as your package will be left out if release candidate bugs are not fixed. Sarge Release Status Update available on Debianhelp . Even if you aren't a maintainer, any help with bug quashing, picking up orphaned packages or what not is always a Good Thing.

33 of 204 comments (clear)

  1. I'm busy installing Ubuntu by advocate_one · · Score: 3, Interesting

    on my laptop... just finished downloading it via torrent. I can't be jiggered to wait for Sarge to come out in final form... How long has it been now in rc form??? I mean, they posted the teaser for Sarge two years ago!!! ridiculous...

    --
    Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
  2. What Debian good for... by barcodez · · Score: 3, Insightful

    I'm not that familiar with Debian so I'm wondering what's Debian's unique selling point? What does it do that others don't?

    My impression of Debian rightly or wrongly is a rather conservative distro with a very rigid/ideological view on which licenses the will package.

    --

    ----
    1. Re:What Debian good for... by th173 · · Score: 4, Informative

      Debian has a very good packaging system with very well definied dependencies. You could install a system and update it over and over again, without the need to reinstall.

      On the other Hand, Debian integrates security fixes without using the new upstream version from the original package maintainer, giving software developers a solid plattform to base the applications upon.

      --
      There's never enough time to do all the nothing you want. --Calvin
    2. Re:What Debian good for... by Noksagt · · Score: 5, Informative

      Debian GNU/Linux is quite ideological. The best writeup on it I've seen is Why Linux? Why Debian?

      I wouldn't call it conservative: Debian comes with over 8000 precompiled packages, many of which are fairly recent (see distrowatch or others for version info).

      Debian is a user-supported (noncommercial) distro that appeals to people with some experience with Linux or which believe in the GNU philosophy. The package manager (apt) is quite good. It is a well thought out distro & (arguably) has had the most succesful branches: Knoppix, Ubuntu, etc.

    3. Re:What Debian good for... by BokLM · · Score: 3, Informative

      What is good with debian is that it's STABLE.
      You can install a server using Debian, and you know that it will last for years. The security update try to never change the version of a program but only correct the bug, in order to avoid possible break. I'm never scared before I run an update on a Debian stable.
      The problem is that the packages can be a little old if you're running the stable version. That's probably not Debian stable that you want for a Desktop computer :)

    4. Re:What Debian good for... by Jason+Ford · · Score: 3, Insightful

      I used to run RedHat. It took me many hours to install MythTV, figuring out which packages I needed, trying to resolve the dependencies.

      Now I run Debian unstable. It took me a few seconds to add a package source for MythTV to my list of sources, run apt-get update, and then apt-get install. apt-get took care of everything.

      Similarly, I wanted to install an ssh server on a Debian box. I just typed 'apt-get install sshd', and apt-get took care of the rest. I shelled into the box a couple of seconds later.

      Debian unstable is much more recent, but supposedly less stable, than Debian stable or Debian testing. I've never experienced any stability issues, save for the rare mozilla crash. I measure my uptime in months, not days or weeks.

      By changing your sources list, you can easily add unstable and even non-free package sources.

      I choose to run Debian because it works very well and fits nicely with my ideals. I switched away from Microsoft because I didn't want to be locked into their technologies, and I switched away from RedHat because I didn't want to pay for security updates and I'm too lazy to answer their survey.

      Debian is free as in speech and free as in beer. It does not lock me into a rigid view.

      --
      I did not become a vegetarian for my health, I did it for the health of the chickens. --Isaac Bashevis Singer
    5. Re:What Debian good for... by TigrOoOo · · Score: 5, Interesting

      I work for a company that makes Linux "embedded" systems. First choice (and only choice) - Debian. One of our servers mirrors the Debian FTPs early in the morning, one hour later all the desktop machines sync with it. All the servers run Debian stable and rely on the security fixes. The systems that we sell all have stable on them too. The development platforms run on testing, and for the hardcore users, we also use unstable. Everything works fine. Sometimes an unstable machine will be, well, unstable, but I have never seen a "stable" give any problems whatsoever. In the beginning we made sure that the updates went well. 3 years later, we don't even bother looking. The installer is text, granted. dselect is a nightmare for beginners, granted. But the systems work, as in really, really work.

    6. Re:What Debian good for... by Confessed+Geek · · Score: 4, Informative

      One item not yet mentioned is that it supports a LOT of differnt computing platforms:
      alpha
      arm
      hppa
      i386
      i64
      m68k
      mip s
      mipsel
      powerpc
      s390
      sparc

      and soon AMD64

      On top of just being really cool in in of itself, this allows you to have a unified computing platform across mutliple legacy, bigiron, and modern consumer x86 hardware installations.

    7. Re:What Debian good for... by pyrotic · · Score: 3, Interesting

      You can do the same with yum on RedHat/Fedora > 7.3. On the other hand, Debian is very bad to install with - lousy support for software RAID, bad X support, very few drivers for fancy SCSI controllers. The scripting support on the installer isn't great comapred to kickstart, and it does it without graphics. You can end up with a 2.2 kernel if you're not carefull. It's a lot of work. There's a good selection of packages available if you know where to look. RedHat/Fedora has weaknesses in the number of packages available, and the hyper release cycles, but so far we haven't switched.

  3. New Slogan Too... by gowen · · Score: 5, Funny
    Debian GNU/Linux : Yesterday's technology ... tomorrow
    Now with extra political correctness...
    --
    Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
  4. Being out of date. by glrotate · · Score: 5, Funny

    It's niche is being so out of date that hackers are no longer familiar with it's versions of packages.

    1. Re:Being out of date. by pyros · · Score: 3, Informative

      You shouldn't run testing or unstable on production servers. They get major version upgrades of packages which introduces new features that sometimes break existing deployments. The stable version only gets bugfixes and security patches, sometimes backported to the version that was shipped. This is necessary in a production environment. blahblahblah.heard.it.all.before.blahblahblah Debian's main selling point depends on the role you want it to fill. But the apt dependency resolving package management system combined with the number of packages available are the advantages universal to every role you would try to fill.

    2. Re:Being out of date. by Sinus0idal · · Score: 3, Informative

      I would agree to this, but the philosophy has its own problems - say I want to run exim on woody... woody still uses exim 3, and if you go to the exim homepage, they state

      "Exim 3 and previous versions are now considered obsolete. Exim 3 is not being developed any further, nor is it being actively maintained"

      And therefore in order to use up to date secure packages, I end up using backports, and thus might as well be using testing anyway due to the package dependancies etc.

      If I want to run an up to date version of horde, I need newer versions of php/pear etc than woody offers, and thus have to backport again... and it goes on...

    3. Re:Being out of date. by Robert+The+Coward · · Score: 4, Informative

      Exim 3 is being maintained by debian developers for up to date security. It wont get new features and support for setting up a new system if you need help as no one outside of debian list will be of much help with exim 3 now but it will still be secure.

      As for horde I agree you either have to use a very old version of use a backport that will install updates that could make the system less stable also programs link clamav are stuck with really old version and make the program usless in stable that is why I do use the backport for it. Area like AV and spam filters are the bigest problem in my option and need a better way to handle in debian.

    4. Re:Being out of date. by Anonymous Coward · · Score: 3, Insightful


      Exim 3 is being maintained by debian developers for up to date security. It wont get new features and support for setting up a new system if you need help as no one outside of debian list will be of much help with exim 3 now but it will still be secure.


      You have no proof of this. Since debian stable users represent the only large remaining user base of these old as god programs, you are at the mercy of a much smaller group of potential auditers.

      Security issues that exist in 3 but not in 4 (ie parts of rewritten code) are more likely to go completely unnoticed.
      This is compounded by the fact that a lot of people are using debian stable and assuming that it's secure because everyone says it's more secure. There is more complacency.

      For example, A debian maintainer saying he is going to maintain BIND8 isn't going to magically make it better.

  5. Oh Debian, I don't know what to think by Hoplite3 · · Score: 4, Interesting

    Debian's strategy of rock-solid releases is something that makes the distro unique. It also doesn't make it much fun. If you want modern packages, you often have to hang out with the "unstable" crowd, rather than the "testing" crowd. But this is like being signed up for regular crotch-kicks, since unstable breaks systems on a practically weekly basis. This, plus dependency creep, makes anything but "stable" debian sort of a drag.

    Stable Debian, on the other hand, is a nice thing. I've always admired Debian's power structure and community focus, but I've been so much happier with my hobby computer when I switched to a more "I-think-I'm-an-expert-but-really-I'm-an-idiot" distro like gentoo. For binary distros, I think there's a big pack of modern flashy desktop ones that eat Debian's lunch. Debian's idealism might end up side-lining it in the Linux world.

    --
    Use the Firehose to mod down Second Life stories!
    1. Re:Oh Debian, I don't know what to think by shrykk · · Score: 4, Interesting

      Yeah, but Debian is used as the sprinboard for a bunch of other distros (e.g. Knoppix) because of its stability and dependability.

      That could be its main strength.

      --
      #define struct union /* Reduce memory usage */
    2. Re:Oh Debian, I don't know what to think by zerblat · · Score: 5, Informative
      I don't agree. I've been using Debian unstable for years, and I can't remember the last time something broke. YMMV etc of course. I've gotten so bored that I've started installing experimental packages in hopes to finally get something to break.

      Anyway, if you want a modern flashy desktop based on Debian, look no further than here.

      --
      Please alter my pants as fashion dictates.
  6. Re:Nice, but... by tod_miller · · Score: 4, Funny

    Hahah what is funny is that if there is any news about old retro dying stuff, it is bound to be on the front page, except of course *BSD :-)

    It is a conspiracy you know. :-)

    In all seriousness - debian sucks the same way as a swedish student doing illicit massage to help get through college - i.e. it is awesome!

    If I didn't use SuSE I would use Debian. If I had another PC *it* would use Debian.

    If I had a swedish student trying to earn her way through college....

    --
    #hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
  7. Re:Sarge... by lspd · · Score: 4, Informative

    We decided to go with Sarge (testing), as we where expecting a final release with security-fixes soon, and didn't wanted to have woody installed and becoming obsolete within a couple of weeks.

    For anyone else considering the same route... If you want a Stable server OS, install Debian Stable. Regardless of when Sarge is finally released, Woody will be supported for an additional year or so. In fact, if you have a Debian stable box and don't want to get pulled into Sarge before you're ready, change your /etc/apt/sources.list file to pull packages from Woody rather than Stable. Let other folks debug the upgrade process on their experimental boxes before you upgrade your production boxes.

  8. Crazy what stops the new release by Anonymous Coward · · Score: 3, Insightful

    Debian has so many packages and platforms that it is hard to release.
    It is even crazier that a game like "Abuse" is listed as a release stopper. C'mon folks. We need a small core that drives the release schedule.
    Maybe this is why ubuntu forked.

    I do love the long support cycle of debian. Can't afford to upgrade a server every year, which is the case for Fedora and friends

    1. Re:Crazy what stops the new release by cortana · · Score: 4, Informative

      The actual release stopper at the moment is getting the Security autobuild network ready to build packages for Sarge.

      While it's true that packages such as Abuse have release critical bugs, the release of Sarge will not be held up by them. Sarge cannot release while RC bugs are present--if it's simpler to remove Abuse from Sarge than it is to fix the RC bug, then Abuse will be removed.

  9. I'd be happy to get a debian based distro to work by FictionPimp · · Score: 3, Funny

    My machine at home can run redhat, mandrake, suse, and even gentoo, but I can't for the life of me get any debian based distro to work on my PC.

    During the base install I will get random package errors. I thought it might be my CD, but i've burned 10 at this point and verified the CRC, so maybe its my sony DVD burner that i'm using to read the disk for the install.

    Here's my specs if anyone has a clue

    p4 3ghz
    intel i865perl motherboard
    audigy 2 ZS
    Samsung SATA 160 gig drive.
    Gainward nvidia FX5900XT
    Sony DVD burner

    Nothing new or special. Tried doing a netinstall of sarge with the rc2 installer. Tried to ubantu (or however you spell it) and i'm going to try a knoppix chroot install tonight. I've tried other's but no luck on those as well.

    Any ideas?

  10. Stable, easy to maintain, fast to install by SgtChaireBourne · · Score: 4, Informative
    Debian's strengths are that its very, very easy to maintain. apt-get makes installation and maintenance very easy.

    It's also very stable and you can get by with a minimal of packages. The approach is to patch exisiting versions rather than force 'upgrades' to newer versions which may or may not change behavior (see PHP for examples of behavior changes even between point versions).

    And it runs on quite a variety of hardware besides lame old x86. I've run classes for semesters off of old junker Macintoshes -- 100% availability, no downtime from course start until the hardware was retired for good the next year.

    It's also very fast to install once you get used to it. (Don't use dselect) I've installed Debian for use as a web/cgi/database server on Pentium machines in under 15 minutes. Including some tweaking, however that needs a fast network connection.

    It's easy to choose linux 2.2, 2.4, 2.6 or a custom variant Linux kernel. I've also read that you can drop in other kernels besides Linux, like BSD. Though I myself have not tried, but would like to read more about it.

    --
    Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
  11. Debian can be thought of as 3 parts... by phorm · · Score: 3, Informative

    All debian varieties can use apt-get (and its partner tools) to contact the main debian repositories. The repositories have a *huge* selection of prepackaged applications/libs/etc that you can install with very little fuss simply by choosing "apt-get install NAMEOFPACKAGE." Alternately, there are CLI tools such as "aptitude" which one may use to select software from a categorical list of packages, or GUI tools such as "synaptic" that do the same in a graphical environment.

    At regular intervals, you may "apt-get update" to update your machine's list of software known to debian. "apt-get upgrade" can then be used to upgrade to known newer versions, or apply security updates in debian/stable.

    For software updates/installations that have configuration options, often you will get a curses-based interface which steps you through basic configuration.

    Debian/stable: As most have mentioned, very stable, well tested, and generally out-of-date as far as new features etc etc (but with security fixes etc being backported). Automatic download/configuration of most new security updates via apt-get. Very nice for servers or other systems that you want to be reliable, but don't need a bleeding edge environment. Packages are generally well-tested against each other, so you have a good assurance that apt-get installing package B will not break package A.

    Debian/unstable: No security patches for unstable packages. Instead, regularly updating will get you newer versions of software. Sometimes you get conflicts but ususally it is fairly stable. I've been using a debian/unstable desktop for quite sometime now... the worst problems I've had thus far is needed to manually select a different "automake" version for Anjuta to work, and having a package that wasn't from debian being broken by a gtk update (mainly because some quirky coding in said package didn't like the new GTK version).

    Debian/testing: I haven't used it, but basically I believe it's supposed to be slightly more bleeding edge than debian/stable. Packages haven't been fully tested against each other, package updates/changes are more common.

    Really, you could think of the above as something akin to freshmeat.net's software grading system, where 'stable' is often for "mature" software packages, 'unstable' includes "beta" or less mature, and 'testing' is very new or "alpha."

    The only thing that confuses me at current is why my Firefox is only avaiable up to version 0.9.3, even in 'testing'...

    In summary though, the concept that debian is for old/crufty software is bogus. This may apply to debian/stable, but unstable will keep you very up-to-date for most users.

    1. Re:Debian can be thought of as 3 parts... by Reteo+Varala · · Score: 3, Informative

      Actually, you have that reversed...

      "Stable" is correct; it's the tried-and-true system that is designed to just work.

      "Testing" means "This will be the next stable, please test it so we can squash out the bugs."

      "Unstable" is the bleeding edge.

      Currently, Stable is Woody, Testing is Sarge, and Unstable is (always) Sid. These names are from Toy Story apparently, Sid is named because he's the kid who likes to torture and destroy toys... pretty apt name for an unstable distribution, eh?

      And I've remembered some fun times in unstable. On average, it can be pretty stable, but if there's a major change (such as the time that X11 was being repackaged in a different way a few years ago; it was three days before my X server would even start up), it will be VERY difficult to manage until the changes are complete.

  12. Great to hear. by quag7 · · Score: 3, Interesting

    This is great to hear. I recently deployed Debian on some production servers out on the internet and they have gone several months without even the slightest quirk or hiccup, under moderately heavy load. I was semi-new to Debian, and I use it on one of my machines at home too; on my desktop I use Gentoo.

    People have a variety of opinions on any distribution, but I can't think of anything easier to maintain, and it's well-documented too.

    I've heard some rumors about the Debian support community being a little crusty and curmudgeonly, but I wouldn't know because I've so far never needed to ask anyone for support. And I'm not that bright, so that says a lot. :)

    On the other hand, I've met Debian users in other non-Linux forums who all have been nice enough folks.

    As I update regularly, it appears from the release announcement that there won't be any added value to downloading and burning it, which is just as well.

    The conservatism here has been a positive things for the server-related things I use it for. I've never tried using testing or unstable as a desktop (where I imagine you generally want to be a little less conservative) so I can't speak to that. However, when I get a new system to replace this miserable 1 GHz Celeron, I'll probably turn this machine into a Debian machine, since running Gentoo on it, with the attendant compiling, is increasingly painful given its speed.

    (Though I'll run Gentoo on the new system :)

    Side by side, they seem to cover two extremes of the spectrum, and work well in that regard, side by side. I haven't even been very curious about anything else but these two. But that's just mey opinion.

  13. Re:Nice, but... by JamesTRexx · · Score: 3, Funny

    So, Debian is to coma as *BSD is to dying?

    --
    home
  14. More important question by Pan+T.+Hose · · Score: 3, Interesting

    First of all, I am a happy user of Debian Woody on the desktops and servers. And let me tell you something: it is stable. And it is stable not only in the sense that the system per se has never crashed during 24h/day heavy load for years, but what is even more important for large networks and offices, it is stable in the sense that no API or system behaviour change while the patches are applied. There are no new featuritis after a stable Debian is released, no version of any program changes to a newer one with even slightly different interface or semantics. There are only isolated security patches. Period.

    If any software has fixed a vulnerability in a newer version of the program, the Debian team backports that security fix to older versions, and that security fix alone. What does it mean? That in addition to the system itself being rock solid, I can be quite sure that my custom applications will not break after patching. And we all know that this is the real reason that makes administrators not patch their systems on time. No one will patch a system if the patches break everything, there would be no point, why not shut down the network in the first place and be done with it.

    But with stable Debian this is a non-issue. And in my opinion, this the reason why real-world Debian installations tend to be generally more secure. As a Debian lover I would love to say otherwise, but Debian is not inherently more secure than Red Hat or Mandrake; Debian admins are not generally smarter than anyone else. Even the APT packaging system is not so important. It is not important who, how or with which tools applies patches. It is even not that important if those very patches are available after ten hours or ten days after disclosing the vulnerability. It is, however, important what happens after applying those patches. Does anything break? Does anything start working different than before? Does it need extensive testing and rewriting of local custom software? If the answer is "yes" then you can be sure that those patches will be rolled back and will not get applied for months.

    That is the real issue. That is the real difference. So now going back to the question:

    "What's holding up Debian Sarge from release to stable? It's those lazy maintainers..... no actually it's just a few issues..."

    I would like to ask a more important question: what does it actually mean that Debian Sarge is released as stable? And as it turns out, it means changing the "stable" symlink from "woody" to "sarge."

    That's right. Sarge is already released and you can use it before that symlink is changed if you need software newer than Woody. The only other thing that will change after the "release" is that feature updates will stop and only security updates will get backported. But the security updates are already available in Sarge, maybe even faster. The only difference is that before the "stable" symlink is redirected to Sarge, you are also getting feature updates of the software in addition to security patches. If that is not an issue for you, then nothing is stopping you from "releasing" Sarge today.

    I hope this will help to understand why Debian users and developers are often outraged when people ask when the new version of Debian is released.

    --
    Sincerely,
    Pan Tarhei Hosé, PhD.
    "Homo sum et cogito ergo odi profanum vulgus et libido."
  15. Going on 8 years... by misleb · · Score: 4, Interesting
    I've had the same install of Debian on my desktop at work for 7 years. I use it exclusively. No Windows on this machine at all. It has been copied onto a larger harddrive, the motherboard/CPU has been upgraded twice, and I've 'apt-get dist-upgrade'd to new stable releases over the years, but it is the same installation." I don't know if this is a "selling point" but it is a sign that Debian is a solid, consistent, and upgradable base. The "purity" of the licensing is just a bonus for GNU geeks.

    -matthew

    --
    "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
  16. Re:Installer by edbarrett · · Score: 4, Informative
    But what I'd really like is the easy graphical installer.

    The rc2 installer was shockingly simple. Still text-mode, but who cares? I believe I *had* to answer four questions:

    • installer language (English)
    • language dialect (I could choose between American, British, and something else)
    • partitioning -- 1 big partition or manual?
    • any additional software?
    That was it. I rebooted, gave it an admin password, set up a regular user account, and could start working. Expert mode (not the default) still allows you to go through the whole "this is too complicated for crybabies" process.
  17. Servers are not supposed to be "fun". by khasim · · Score: 3, Insightful
    Debian's strategy of rock-solid releases is something that makes the distro unique. It also doesn't make it much fun.

    Servers are supposed to be "boring", "dull", "mundane", "reliable", etc.

    I run a few Debian servers and they never give me any problems. Patches go in without any problems. They never do down. They just keep serving.

    I've always admired Debian's power structure and community focus, but I've been so much happier with my hobby computer when I switched to a more "I-think-I'm-an-expert-but-really-I'm-an-idiot" distro like gentoo.

    Gentoo is great on a desktop. But a desktop has completely different requirements than a server. A desktop can get by with an unstable app.

    A server should not be running anything it doesn't absolutely have to and everything it runs must be rock solid. Debian gives me all of that on a server.

    For binary distros, I think there's a big pack of modern flashy desktop ones that eat Debian's lunch. Debian's idealism might end up side-lining it in the Linux world.

    Maybe.

    Knoppix on the desktop is awesome and it is Debian. One Knoppix CD + a USB toy and you've got it all.

    Debian on the server may not have all the Oracle support and such that Red Hat does, but it handles just about everything else.
  18. Here's a blanket statement by Kjella · · Score: 3, Interesting

    GUIs are vastly superior if you're doing a task which requires you to find one item among many, without proper search parameters. This may be a file you're trying to locate, or a configuration option. This is even more superior if this is a task you do rarely or only once.

    CLI is vastly superior if you're doing rutine tasks. They are typically more flexible, have more options and offer more ways to manipulate and automate them. Auto-complete (a must) makes it about as easy to select files as in GUIs.

    Of course, the G in GUI is mostly eyecandy. TUI (Text User Interface, think text-based menus), though rare, provide mostly all the functionality of GUIs, unless you're specificly doing something graphic like viewing/manipulating images.

    What I really really do miss is more hybrid interfaces. Where you can do things graphically, and yet command the full power of a CLI. I don't see why it has to be an either-or. I don't mean 1:1 maps of CLI->GUI which are basicly eyecandy, but programs where the GUI is useful in itself, and the CLI readily available.

    Kjella

    --
    Live today, because you never know what tomorrow brings