Slashdot Mirror
Debian 3.0r4 Released
SeaFox writes "The Debian group has released an update to the 'Woody' distribution of the popular Linux/GNU OS. From the site: 'This is the fourth update of Debian GNU/Linux 3.0 (codename woody) which mainly adds security updates to the stable release, along with a few corrections to serious problems. Those who frequently update from security.debian.org won't have to update many packages and most updates from security.debian.org are included in this update.' But the question on everyone's mind is probably when the current Testing branch, featuring much more up-to-date packages, will be named the new stable release."
But the question on everyone's mind is probably when the current Testing branch, featuring much more up-to-date packages, will be named the new stable release.
Oh, come on! When will the submitter realize that stableis what most of us want to run on our servers and mission-critical hardware. I for one cannot afford doing an apt-get upgrade and breaking three, two or even _one_ package. Even worse would be putting a serious bug in the software on a production machine. With stable this chance is minimal, but of course not non-existant.
One possible solution would be to divide Debian into a "server version" and one for the workstations who actually _want_ (or need) to run stuff from testing. Although this would mean double the work for the package maintainers (et al) I'm sure it would make Debian even more attractive as a desktop alternative. Today, I don't know a single n00b or even semi-n00b using it for her home PC or similar - it's all Windows, Xandros or possibly SuSE. On the other hand basically all of my friends who proudly call them selves sysadmins are running Debian (stable) on their production boxes...
Unless of course they need to run RH to get IBM to support WebSphere =)
I've always defended Debian Stable's stale package versions for the sake of stability, but recently a serious issue has arisen. The recent PHP security flaw has made this issue apparent. The version packaged for Woody is 4.1.x. The PHP developers no longer pay any attention to the 4.1 branch and their recent release for the newer 4.x release which fixed the security issues, also had other fixes included, making it difficult to backport them to the 4.1 branch. Last time I checked, no one on the Debian side had stepped up to fix the issue in 4.1.
Something really needs to happen here (and installing 3rd party backported packages is not a clean solution). Perhaps a policy that packages that are no longer supported upstream will be upgraded in stable.
Some packages, such as MPlayer, I know are tested enough by the development team that I'll take the newest version as soon as it comes out. Others I'd prefer to know someone else has taken some pain with it :-)
Just my .02 worth
---
For more of my ramblings, look here
Seriously, ever try installing Woody on a new machine with a new hardware RAID controller? You can't, you need a custom hacked install CD. I admin a bunch of servers and my boss likes Debian, however I'm sick of having to bend over backwards to just install Debian on our new rack boxes, much less try to use up-to-date packages. I'm going to try to sway him towards FreeBSD. Debian was a great thing back when compiling packages took hours and hours, but as fast as machines are these days waiting several years between stable releases is not viable. On top of that, with the time spent on debian-devel discussing (and flaming) trivial things like package ratings (someone posted an ITP for some R-rated thing), it's all just a waste of time.
Why dont you use Synaptic or Aptitude if you dont like dselect. Synaptic has nice usable gui and aptitude is much better than dselect if you like working on a terminal
>> Techflock-flock onto the best bits of technology
Six month release cycle, new packages, desktop orientation.
Peter
A: "Debian is all old!"
B: "Yes, but it's stable and it rulez in professional environments where you can't crash"
C: "Um, but Red Hat has pro support, if you're a pro"
B: "You can buy support from vendors"
D: "Don't people realize stable means stable, and testing means testing and it's wonderful that there are so many options?"
E: "My Gentoo system rox!"
A,C,D: link to sites like funroll-loops.org
F: Hypes up debian-based Knoppix.
G: Hypes up debian-based Ubuntu.
A: "Debian testing is still old, I need new"
B: 'You could try gentoo, you unfaithful kid".
yadda yadda yadda.
You shouldn't abondon a platform because of a one bad tool for which there are alternatives.
I've been running Debian Unstable on my home machine for a few months and I have to say that it's every bit as stable as the Fedora install it replaced on the same hardware. It's my main desktop at home and gets quite a workout.
The Debian "unstable" branch is as stable (at least for me) as any Linux distribution that I have used. Fast, too.
God is imaginary
That's exactly what the name "stable" refers to. "Unchanging", you put it on a server and expect to only need to update for security fixes.
That's why it is so long between stable releases... They have to make sure you can install and forget (except for the security fixes).
If you want a workstation use ubuntu, essentially a combination of testing/unstable. Or unstable.
RPM is a package that sucks balls too.
I hear that a lot, and occasionally someone who knows the differences between rpm and dpkg comes out and says what the differences are. I forget what they are, but I don't believe they are anything that a regular user might care about. rpm and dpkg are basically equivalent.
Has anyone noticed that the RPM distributions are starting to use the apt-get approach?
Of course, is there something in dpkg that makes it more suitable for apt/yum like functionality than rpm? Fedora supports both apt and yum frontends for rpm.
In fact I'm using both Debian and Ubuntu myself and kinda hope that they switched over to rpm. rpm is a standard as specified in LSB, and existence of two popular, basically equivalent tools w/ different interfaces (command line switches) and file formats seems like a waste of effort to me.
Save your wrists today - switch to Dvorak
Move to Debian Testing (Sarge) which should be released as Stable soon. Includes Gnome 2.8 and will
include KDE 3.3 when it filters through. D-devel
has always been a bit like that anyway, FreeBSD will
possibly not give your boss what he wants or give you the breadth of readily installable packages.
Comment removed based on user account deletion
Quite a few people are commenting about using testing or Sid instead of stable, for a desktop. And other comments include using testing or backports if you don't like stable for a server.
/., perhaps in one of the posts, or elsewhere (distrowatch maybe), or on one of the mailing lists. But I haven't seen anything.
The problem is that even though sid is fairly stable compared to other popular Linux distros (though things do break occasionally), others in this same story, and rightly so, have said they would never use sid for a server. The whole purpose of stable is for running a server these days. I'm sure there are some users out there that may use stable for purposes other than a server (Bonzai was good enough for me for low resource hardware, when I installed it, it was based on stable, don't know now). But most users who are installing stable on a new server, with new hardware, have rightly pointed out that many pieces of the new hardware either don't work, or if it is possible to get working, have to be heavily hacked.
If stable were newer, it may be considered more for company installs, as long as the Oracle or Websphere, or whatever other certification doesn't require Red Hat or Suse. And I'm sure that even in companies that run Red Hat or Suse for some applications that need it, may also run Debian Stable for some purposes where they can just set it and forget it!.
I've tried stable in a newer computer. And besides the difficulty with some hardware, I found X with XFce difficult to use. Even though it is a server install, I still find it easier and more productive to install and use KDE gui apps for administration. Sure, I use the server for development also. It isn't my main development box. But for tweaking some html here and there, dragging and dropping files here and there quickly, and for some other purposes, I simply prefer a gui to do it with. I would've used Firefox (wasn't out yet) or Mozilla with another app for file browsing, but I like konqueror for web and file browsing (and fish/ssh) and a few other utilities it is good at. And though KDE is really bloated and I'd like to free up some space (every time I try uninstalling something KDE related, it wants to uninstall most or all of KDE or important libraries, like trying to uninstall XMMS, or other KDE utilities or apps), but KDE or synaptic won't allow it. Synaptic is another reason for my running X. And that I also wanted to try out Quanta Plus.
The release I'm using on the server is testing. As some other posters have suggested using. But the problem with testing is that it doesn't get the attention of the security team. I believe this changed a month or two ago because testing is close to going stable. But I'm not aware of a security repository for testing. I'm sure I would have seen an announcement about it here on
If the testing distro did receive the attention of the security team, and there were security repositories, then that would make testing far more palatable for many users as a server distro. With careful updates/upgrades, it would be a good solid release for a server, with much more up to date applications.
My testing distro was once Mepis. But once installed, I uninstalled some unnecessary apps, fixed my sources list, and slowly but surely, the install is becoming 100% testing. It currently has KDE 3.2.3, instead of the KDE 3.3.x version. I haven't taken a look at KDE 3.3 yet, nor do I plan to install it, as that would entail switching to unstable for a few repositories, and pinning, two things I don't want to do. But KDE 3.2.3 is working good for me, and as I stated, it is on a server install, so the latest and greatest isn't necessary.
I had planned on waiting (when Bonzai didn't work out for me) for testing to become stable. Good thing I didn't, because I never would have got anything done. Since I got tired of waiting though, I installed testing, and now hope KDE 3.3
RPM can do this, too. IIRC, recent Fedora systems have dependencies on smtp-daemon, which can be satisfied by either sendmail or postfix. And it provides system-config-mail which supplies a sendmail interface which dispatches to the one you have configured.
.rpm can be file-oriented. It's the choice of the one making the package.
I'm not aware of anything .deb can do that .rpm can't, despite Debian fans raving about their superior package format. All of these things are more about the way the packages are made than the actual format.
Comment removed based on user account deletion
All you do is add more than one source in sources.list. apt works through them in order until it hits a source without errors. Isn't that simple enough?
Settings up bittorrent trackers or gnuttella networks for this might be worthwhile as well.
A nice thought, but more open to tampering of the packages. I'm sure it wouldn't too hard to hack in (as far as challenges go), but statements like this are easily said by those not doing the code
Besides, as a user and admin, I see absolutely nothing wrong with the current distribution system. As a mirror operator, it's probably a lot of data to keep in sync but I don't know.
Dependency resolution has started to see some cracks. Virtual packages that force you to choose one manually and so on so forth.
This is utterly deliberate, in fact it is a feature. Why should Debian choose for you? How would they decide? Have they got the right to decide? Not saying there's no room for improvement, but I'm interested in how you would propose to improve the current dependancy system.
More cryptography signing and verification for packages.
This I agree with. It would be nice to know that the whatever mirror I'm using hasn't been compromised and packages tampered; at the moment when you do apt-get update you get a list of md5sums for every package and if they don't match once downloaded, there's an error.
Of course, an attacker could modify the md5sum string in the package lists to match his tampered package - on the other hand, I guess with rsync the lifetime of the tampared file can only last until the next rsync, and some mirrors do this up to 6 times a day.
An easier way to search for available packages based upon filename, title, description, man pages provided so on so forth.
Use: apt-cache search for searching package names/descriptions, and apt-file to not only find what package owns a file on your HDD, but also list files contained within a package. Not sure what you mean about searching by man pages provided, do you mean by searching the contents of the man page? I'm pretty sure there's nothing in a package's man page that's not in the searchable description that would stop you from finding the package.
mode whereby you can safely schedule apt-get upgrade to run from cron. Currently thats not completely safe to do without any human interaction. Call it apt-get computer-upgrade.
It's called cron-apt, and I think this is a good time to show an example bash session: