Debian Struggling With Security

Masq666 wrote to mention a ZDNet article discussing difficulties Debian is having with security updates. From the article: "...Lack of manpower also appears to be adding to Debian's security woes. Michael Stone, another member of Debian's security team, expressed his frustration to the organisation's security e-mail mailing list in mid-June, saying there was no effective tracking of security problems."

Comments

Solution is obvious, move to Windows

[VisualVoice]

They have a huge team focusing on security.

Re:Solution is obvious, move to Windows

[sharkey]

They have a huge team focusing on security.

Too bad none of them work at Microsoft :(

Re:Solution is obvious, move to Windows

[Anonymous Coward]

Actually, in the center of this team, authorized to make decisions, are only 7 people. Only 1 of these 7, Martin "Joe" Schulze, is actually active. The other 6 seemingly retired from their job, failing to take care for somebody to replace them in the security team.

Take this and add some server problems since the Debian update and you see where's the problem.

Pick any two

[mcrbids]

Secure, Convenient, Cheap.

Pick any two.

(General rule, but it does generally follow)

Re:Pick any two

[diamondsw]

Or pick Windows and get none!

Re:Pick any two

[hunterx11]

I thought it was secure, fast, cheap. And I thought I knew which two Debian had picked :)

Re:Pick any two

[HawkingMattress]

Yep but it doesn't apply here. Debian can be secure, convenient and cheap. It could probably be more secure and less convenient but still it is generally a very secure distro... and it's certainly cheap and convenient too
The problem is not that you can't mix those three in debian particular setting, it's that the debian team seems to serverely lack redundancy. Read: one person has obligations somewhere else and the whole stable security updates process hangs !
I really hope that Debian is going to make something about it fast, and in a definitive way. I don't want to run something else than debian, really. But this is really embarassing, especially if you have production servers running sarge. And this situation ain't new, Slashdot was very slow to catch it but i read about it last week. Things haven't moved a lot since (well 1 security update was released, but some major exploits have been found in iirc at least two other packages, and nothing coming yet... Other distros had everything fixed by the end of last month)

I think Debian should clarify the issue, and call for help if it's necessary. And maybe simplify the whole debian democratic process if as it seems from the outside every decision has to go through days and days of pointless discussion.

Re:Pick any two

[GNUALMAFUERTE]

Slackware is secure.
Slackware is convenient (I Know that many will say otherwise, but if you have Unix experience, it's the best solution, really easy to manage)-
It's cheap, it doesn't contain any proprietary software.

Also, Debian can be as safe as Slackware, the problem with this kind of Distro (Debian) is that the people using it pretends that someone else takes care of their security. A Sysadmin doesn't need some stupid organization to submit patches to him automatically or anything like that. He just has to download and compile all of the critical services of his system, and update them when necesary. Anyone that says otherwise is an Amateur, not a Sysadmin, and if he's an amateur, he shoudln't be running any system bigger than he can manage, and he shoudln't run any critical services, and for the kind of things that an amateur should host the kind of security provided by allmost any Unix system is more than enough. The problem with all this shit is that there are lots of amateurs out there calling themselves sysadmins ...

Re:Pick any two

[jguthrie]

How do you determine which version of a given program is installed on a Slackware system?

Re:Pick any two

[GNUALMAFUERTE]

First of all, a sysadmin *must* know exactly what he has in his system, but, if you need to know, 99.99% of Unix software has a --version option ...

Re:Pick any two

[chris_mahan]

what do you mean cheap?

Debian costs pennies to download the 2 floppy images ans windows XP pro is $199 (the average yearly income in Banglasedh)

Re:Pick any two

[cleverhandle]

Something like...

cat /var/log/packages | grep foo

? Been a while since I've used Slack, but it's something like that. It's not like the package info just disappears into thin air or something. If the pipe offends your aesthetic sensibilities, just make a script or an alias for it.

Re:Pick any two

[koreaman]

Why, because you have a choice? In Windows you don't have to use the command line, in Linux you do. In Windows you still can as much as you like, though.

Re:Pick any two

[Sketch]

> How do you determine which version of a given program is installed on a Slackware system?

ls -l /var/adm/packages/packagename*

(Assuming Slackware 8.1 or greater)

Or, as one of the other posters suggested, run "program --version". Pat and friends don't usually backport security fixes like Debian and Redhat, they just update the packages to the fixed version. This makes it much easier to tell if you are vulnerable to a specific vulnerability without having to wait for your vendor to tell you if that particular bug has already been fixed in your distro's package or not...

simple solution

[Geekboy(Wizard)]

$ apt-get update security-officer

Problem Solved.

(Its funny. Laugh.)

Re:simple solution

[goofyheadedpunk]

If you actually have to tell us it's funny, is it really?

Re:simple solution

[Gogo0]

You KNOW that someone out there tried it...


me

Re:simple solution

[cortana]

It would be "apt-get install security-office" anyway.

Re:simple solution

[Azrel666]

Surely, if it's lack of manpower, then; $ apt-build security-officer =)

Re:simple solution

[Anonymous Coward]

That was so stupid I unlaughed and sucked the happiness from the room.

Re:simple solution

[AuMatar]

Did anyone else think "Now how are they going to upgrade Worf?" when they read this?

Re:simple solution

[cwalker]

Actually its now aptitude install security-officer...

Re:simple solution

[hatrisc]

you're forgetting that the slashdot crowd knows nothing anyway.

Re:simple solution

[bluemtoo]

Thanks a lot! I just ran that and now I can't get into my box!

there was no effective tracking of security probl

[frovingslosh]

there was no effective tracking of security problems

Now that this has been published on /. it will have to be revised to "no effective tracking of security problems by the good guys".

How the mighty have fallen...

[Gorath99]

Disturbing to see how the distro that was always renowned for its reliability is now having such troubles.

I wish the debian team all the luck in the world in fixing this matter. They're in a difficult position now that they're both lagging behind (though much less so than a while back) and cannot claim unparalleled reliability.

Re:How the mighty have fallen...

[Ingolfke]

I wish the debian team all the luck

I think this is probably part of the problem... too many people are wishing them luck and not enough people are actually doing anything to address the problem.

Re:How the mighty have fallen...

[arivanov]

First, there is a policy problem here. If a security update is not available due to lack of build systems for a specific architecture (ARM), well so be it. It should not hold the updates for all remaining architectures the way it does now.

And if someone wants to see security updates for this specific architecture (ARM) they might as well donate. The only ARM motherboards useable for a build system are the developer toolkits and these cost money.

Re:How the mighty have fallen...

[tacocat]

It would be a hell of a lot easier if they only supported X86 architecture like all those other Distros you refer to as the ones to lag behind.

I think what they really suffer from, and I am not expert, is politics of a large system and the perception of lots of power sitting on top. I could be wrong.

Regardless of what anyone might want to say against Debian, I still believe that they are extremely good at what they do and don't get credit for it. There is no other distro out there that attempts to support as many architectures as effectively (or at all) and if Debian decided to just delete them all except X86/X86-64 then their job would be a hell of a lot easier to execute.

Re:How the mighty have fallen...

[dmaxwell]

Supporting arches that span the gamet of bitness and endianness shakes out bugs and bad assumptions that can be hard to find otherwise. These fixes get pushed upstream whenever possible. So Debian is raising the water for a heck of a lot of boats. Until the great license blowup, Debian's X-Strike Force was also a major reason why XFree86 ran on so many platforms. The bit and endian issues THERE are a bitch.

It might be better in some respects if Debian were x86 only like everybody else but we would all be poorer for it.

Re:How the mighty have fallen...

[Murphy Murph]

gentoo, open/free/netbsd all support any debian supported architecture.

I do not think you understand what support means in this context.

Re:How the mighty have fallen...

[EzInKy]

I think this is probably part of the problem... too many people are wishing them luck and not enough people are actually doing anything to address the problem.


Well you have to admit, the Debian elite have not exactly been known to welcome new users with open arms. Don't get me wrong, I really have a great admiration for their work, but it would seem to me the best source of new developers would be from a pool of motivated users.

Re:How the mighty have fallen...

[SocietyoftheFist]

I certainly have no reason to help them, financial or otherwise. You say that they are having trouble getting volunteers? I say free Linux distributions are niche players now. SUSE and Redhat don't have the market share they do because of volunteer efforts.

Re:How the mighty have fallen...

[Nimrangul]

I really doubt that the Debian team was the major factor in getting XFree86 to run on multiple platforms, last I checked NetBSD and OpenBSD also used it prior to the license debacle and I'll bet ya they submitted patches too. And, since they both run on more platforms, they probably helped it work on so many platforms too.

Perhaps it is better to say Debian's team contributed to XFree86's stability on multiple platforms.

Re:How the mighty have fallen...

[runswithd6s]

I think what they really suffer from, and I am not expert, is politics of a large system and the perception of lots of power sitting on top. I could be wrong.

Actually, I do think you're wrong, but I am biased in that I'm a Debian Developer. Developers only have to get involved in "politics" if they really wish, but the bulk of developers happily work on the half-a-dozen or so packages they're maintaining and leave the "politics" to the people who care about them. I consider myself amongst this group of moderates, if you wish to pin political terminology upon us.

So really, what is political about security fixes? Nothing, and the mechanisms for updating packages do not revolve around politics either. The basic formula is:

• Email security@debian.org with a description of the bug your package is afflicted with.
• A patch is helpful, but remember that only the security team is allowed to upload the new, signed package.
• Let the security team handle the rest.

I want you to notice a couple things about this process. The developer is equally responsible as the security team for recognizing a security bug (via watching security bulletins, etc) and for responding to bug reports against his/her package. Even if the patch isn't backported against the Stable package, the developer should notify security@debian.org that there is a problem,

And finally, note how the responsibility for uploading the new binary and source packages lies in the hands of the security team. This is where our concern lies. Is there enough people on the security team to cover 1500+ packages? Probably not. I believe that this is the reason the blog entry was made. Not to undermine or discredit Debian, but to address a shortcoming that can and will be addressed.

Re:How the mighty have fallen...

[tacocat]

Actually, I do think you're wrong, but I am biased in that I'm a Debian Developer. Developers only have to get involved in "politics" if they really wish, but the bulk of developers happily work on the half-a-dozen or so packages they're maintaining and leave the "politics" to the people who care about them.

Glad to hear it. I didn't think there were very many people who cared for the political game, but I've heard people whining over the years.

I guess as a long term Debian user I need to find out more about this security team and their choke point. Sounds like upping the team makes sense.

Re:How the mighty have fallen...

[drsquare]

In this industry, if you're not going forwards, you're going backwards. The Debian team have just rested on their laurels, the system has stagnated and it slowly becoming obsolete.

As a computer programmer, you want to be doing things. You want to be making new things, innovating, making progress. It must be soul destroying to sit there on the same slow project, not much getting done, testing the same old packages over and over again, because the management don't have the gumption to get it released and think it's still 1995. It's not a surprise that they're struggling to find people to work on it. And when they do find people, they're not exactly welcoming.

Another problem is that a lot of the benefits for using Debian have evaporated. Other distros have good package installers; apt was good, but gentoo have pretty much stolen its thunder, and you can get equivalents for the other distros. Other distros are just as stable and reliable nowadays. And they manage it with newer packages, so the argument that 'old is reliable' doesn't hold as much sway.

If I were making a distro, I'd want it to have some sort of 'killer' feature, something that sets it apart from the rest. Debian doesn't have that anymore. Progress in open source software moves FAST. Faster than the Debian team can keep up with.

Re:How the mighty have fallen...

[paultt]

the other great thing about debian, in addition to numberless packages :-)) it's its portability... i've got it installed on sparc, powerpc, motorola, intel, just because this i've got. and with almost the same package list and conf files :-)))) not a li'l detail, i think the security is not in the distro, it's in the man using/installing/configuring it....

Re:How the mighty have fallen...

[dmaxwell]

I said A major factor. Not the major factor.

Re:How the mighty have fallen...

[Lord Kestrel]

Last I checked, Gentoo is fully supported on the following archs:
x86, x86_64, sparc32, sparc64, mips, ppc, ppc64, alpha, hppa.

It also runs on the following, but probably isn't considered stable:
sh, m68k, s390, arm, ia64, x86_freebsd, ppc_darwin

That's at least as many supported platforms as Debian, probably more. Yet Gentoo still manages to come out with security updates very quickly.

Now If This Was Microsoft...

[Anonymous Coward]

The tone of the story would be laden with arrogance and derision towards the "Borg", painfully unfunny and unoriginal jokes would follow, and everyone would point to Apple and Linux as the greatest and secure OSes on the planet.

But since it's not Microsoft, it's a fairly sober writeup, and Microsoft jokes would just follow a little bit later.

Funny how things work here at slashdot. no i'm not new here. I'd just figure some people would grow up sooner or later.

Re:Now If This Was Microsoft...

[leecn]

Dont be such a whinger

Debian is way more secure than windows, how long do you think it would take the average debian box (connected to the net and unfirewalled) to get owned?

I like your style though, posting as AC while claiming not to be new.

Re:Now If This Was Microsoft...

[Pooh22]

The thing you're not taking into account is that Debian's security team, while having a professional attitude, are volunteers. Microsoft has more money than it can spend (legally), so has no excuse in terms of "lack of manpower", unless they don't exist on the planet.

Come to think of it, perhaps they're all working at Microsoft? Or maybe Microsoft could help out the Debian guys by funding some FTEs for Debian's security team, since it will help secure the Internet (which runs for a large part on Debian systems anyway ;-)

Cheers

Simon

Re:Now If This Was Microsoft...

[Brandybuck]

I'd just figure some people would grow up sooner or later.

Oh we do indeed grow up. Unfortunately Slashdot has an unending supply of new posters straight out of kindergarten who have no problems at all firmly believing in the rightness of double standards and the logic of conflicting axioms.

Re:Now If This Was Microsoft...

[Anonymous Coward]

This is slashdot, news for nerds who have a psychological need to identify with the underdog in every situation.

Seriously, I think it's the result of being the outcast for most of one's childhood. By believing that the outsiders Linux/Apple are the best, they elevate themselves by proxy.

Re:Now If This Was Microsoft...

[The Bungi]

The thing you're not taking into account is that Debian's security team, while having a professional attitude, are volunteers. Microsoft has more money than it can spend (legally), so has no excuse in terms of "lack of manpower", unless they don't exist on the planet.

Interesting. So given enough money, security problems with Microsoft product must be ascribed to... Laziness? Stupidity? Malice? Incompetence?

The counterpoint of this being of course that since "given enough eyeballs all bugs are shallow" we must ascribe security problems in Debian to... Laziness? Stupidity? Malice? Incompetence?

Or maybe it doesn't really matter, does it? Or do you think that throwing money|volunteers at a problem will fix it?

BTW, you are hereby given notice about using the "but they're volunteers" excuse. Linux is supposed to be an enterprise-class secure, stable operating system regardless of whether it's being sold, given away or traded for cheezy knobs. Or so I've heard around here.

Re:Now If This Was Microsoft...

[thelexx]

And if it were Microsoft, the derision would be _justified_ motherfucker.

Re:Now If This Was Microsoft...

[DogDude]

Linux is supposed to be an enterprise-class secure, stable operating system regardless of whether it's being sold, given away or traded for cheezy knobs. Or so I've heard around here.

Come with me... I have a bridge to sell you...

Re:Now If This Was Microsoft...

[Ernesto Alvarez]

You've got to admit there is a fundamental difference that would also cause that change of attitudes.

Debian security guys tend to have an attitude of trying to do things right. You're talking about the same people that chose to stop everything when they were compromised last year (and that was two days before a woody revision release). It's no surprise that people think of them as a good team without the necesary resources that need help. After all, they appear to do what they can with whatever resources they've got.

Microsoft, however, is known for turning a blind eye to big problems, trusting no one will find out and trying to NDA the hell out of everyone. Considering people pay big $$$ to them, and they do play dumb more often than they should, guess what the attitude toward them would be.

MS has been doing things a little better lately, but years of treating security like they did in the '90s aren't forgotten that easily.

I like Debian, and really hope they can solve their staff shortage. I wouldn't like them to go under because of this.

Re:Now If This Was Microsoft...

[eluusive]

Laziness, Stupidity and Incompitence all fit quite well. You seem very pro Microsoft. Apparently you haven't looked at the implementation of most of their products. The interface design, and data output, among other things, reak of poor design and novice programming. Take a look at the raw data word spits out, or frontpage, or anything else. Look at the "registry." They all lead to the realization that the person tasked with writing those features didn't really know what they were trying to accomplish.

Re:Now If This Was Microsoft...

[ozmanjusri]

Stupid retarded zealot punk, try growing a brain. You'll enjoy the experience enourmously

I am a pedant, not a zealot. As a result, I will be deriving enormous pleasure from correcting your misspelling of "enourmously" [sic]. Thank you for playing.

HAND.

Re:Now If This Was Microsoft...

[bad_outlook]

Now If This Was Microsoft... by Anonymous Coward

You say you're not, but you *must* be new here.

Re:Now If This Was Microsoft...

[leecn]

If you had any clue what so ever you would see that a Debian box connected to the net and unfirewalled that is not updated extremely regularly could be owned within minutes.

A *base* install? really? Bullshit

I mean the Debian developers will tell you this

Bullshit, they wont. I have servers running live on the net for months on end with no firewall and a bunch of services turned on, and have never had a problem

I am not some retard who blindly says 'linux is best'. You have cast yourself as the nemesis of these misguided individuals, which is fine, but you dont need to tell lies to try to illustrate your point. Obviously Debian, and other distros have weaknesses, in terms of security, usability etc... A base Debian installation usually only has ssh listening, so if you can exploit sshd then you are doing well. Also, lots of services will only listen for incoming connections from remote machines if you explicitly tell them to do so (apache, mysql).

I expect that you think the default windows set up (running everything as root) is also a good idea?

Slashdot is full of retards, just like you

Poor baby, maybe if you hate it so much you should fuck off and read osnews instead you peasant.

Re:Now If This Was Microsoft...

[The Bungi]

Debian is a

OMG, the semantic nitpicking of the distro/OS/kernel thing! Never seen that around here before!

You are a troll/astroturfer.

Of course I am! What was it that gave me away? The .sig? The fact that I'm not one of your sheep groupthink friends? Inquiring minds want to know!

Re:Now If This Was Microsoft...

[The Bungi]

Laziness, Stupidity and Incompitence all fit quite well.

We agree on this then? OK, thanks.

You seem very pro Microsoft.

Yes, they pay me a lot of money to discuss the finer points of application data processing with people like you, on Slashdot. That was an amazing catch.

Apparently you haven't looked at

The raw data, from Word. And FrontPage. Yes, that makes sense. The raw data. You figured this out all by yourself, did you? Impressive.

Boring jobs

[ignorant_coward]

It isn't any suprise that the boring and the mundane tasks fall short in manpower.

This is why there needs to be more commercial involvement in FOSS, so that people who just want a day job and a paycheck can do these sorts of things.

Re:Boring jobs

[ignorant_coward]

Okay, please tell me how you pay for these people who need a paycheck.

Sun, IBM, HP, Novell, Red Hat, SuSE, etc. for non-Debian FOSS development.

Debian doesn't exactly have a profit generation model.

That was the path they chose.

Re:Boring jobs

[SirSlud]

I understand what you're trying to say with your sig, but when you're as smug as you seem to be, you lose the priviledge of calling somebody else on their biases.

That out of the way, capitalism is about capitalizing labour; that is, putting people together that create more value than if they worked seperately. That is the fundamental reason why we CAN sell things; we're able to capitalize labour and create things for less cost than would be born upon people if everybody created said thing individually.

Statements like your are grossly off the mark. BSD licenses, any other open source licenses that allow you to use the source but not have to open up your own, have helped many a person make money. What folks like you fail to realize is that you use the term open source as if its a catch all for anybody creating software for free. In fact, irony of ironies, the patent system was designed to FORCE your methods and secrets in the open in return for protection from the government. So who's being anticapitalist now? The very tennants of innovation in capitalism are strongly tied to having people share information. The anti-capitalist yahoo's of whom you speak simply have a much broader, more historically acturate understanding of the balance between technological progress and motivation to innovate. I'm not against selling stuff, I'm not against capitalism, I'm simply suggesting that once the fear dies down in a decade or so, and code itself becomes more commoditized, it will be in the interest of those who wanna make a shit load of money to patent software based on the source, not a description of what the thing does.

Look at early patents; its not what you can do, its HOW you do it. Its the means, not the end. Nobody could patent the generation of electricity; only METHODs for generating electriciy. I predict that at the rate of current software patent filing, litigation will become too expensive for the market versus the costs of opening up source in order to protect your invention. I guess thats ironic, given people's fear of open source licenses.

Re:Boring jobs

[Ogerman]

That out of the way, capitalism is about capitalizing labour; that is, putting people together that create more value than if they worked seperately.

Implemented properly, Open Source is fundamentally about transforming the software industry into a pure capitalist labor market which is free of most artificial barriers and regulations. The key is really how to pool resources so that those who need software can pay for its initial development. (the capitalist value is in this initial development labor, not the final product which is freely shared and replicated at no cost)

At first, it sounds like a free-rider problem waiting to happen, except the reality is that:

1.) The largest percentage of software produced today already involves either contracted or in-house development.

2.) In a highly competitive market, a cheaper solution that gets the job done is usually the best option. Even if ones competitors can partially free-ride on it later, they're already far enough behind that it doesn't matter. Either way there's always the cost of implementation, customization, and internal support -- these don't go away just because something is Open Sourced. (If you're really smart, you can spin off a new division and make money supporting the software you wrote or enhanced in-house!)

3.) Paying for Open Source development doesn't necessarily mean starting a new project from scratch. It could be development of one needed feature in an existing project that is otherwise satisfactory.

..it will be in the interest of those who wanna make a sh** load of money to patent software based on the source, not a description of what the thing does.

Hm.. I'm not quite sure what you're getting at here. Copyright is adequate for protecting a particular implementation whether the source code is open or not. Patents have no logical place whatsoever in software.

Re:I ditched debian over the weekend

[Zemplar]

Switch to Solaris 10. Even in the very unlikley event you hose your system, just reboot from your last "live upgrade" partition and your back into production.

Too many packages?

[slavemowgli]

It's just a random thought, but have the Debian people ever contemplated whether their problems in this regard may stem from the fact that they have too many packages? The package list for the latest stable lists an incredible 16834 individual packages, and even though there are many programs which come in different flavours and thus contribute as more than one package, this still is a huge number.

I can certainly see why security management gets a problem here. Maybe the Debian project should cut down on these and see just how many packages are really needed.

Re:Too many packages?

[sneakers563]

I wonder whether it's that, combined with the effort required to backport security fixes to versions that are often (let's face it) several years old. I'm not trying to start a flamewar, but I'm curious, why does backporting a security fix make for a more "stable" program then simply embracing a new version of the software that's been fixed upstream? It seems like the upstream people would do a better job anyway, as they are presumably more familiar with the software to begin with. Or is it when the Debian people say "stable", they mean a stable feature set and not necessarily stable security-wise?

Re:Too many packages?

[Anonymous Coward]

Well, they should definitely cut down the packages that are considered "securable" by the core security team. There should be a large category of "contrib" (but that means something funny in Debian, free software that depends on non-free, so a different name...) packages such as minority mail servers and web servers which aren't treated with quite the same importance as postfix and apache, say: if you install them, it invalidates a "main line security" flag.

That's NOT to say the "contrib" packages would be insecure, just that all responsibility for security of the package and its interactions with other packages would be up to the packager and packager user community.

Re:Too many packages?

[Chmarr]

Well, it works for the OpenBSD people... OpenBSD is the most secure system out of the box because the box is really small, and it's hard to get it open :)

My karma is now really, really shot.

Re:Too many packages?

[jpc]

It is certainly the case that many upstream maintainers really dont care about old versions of their software (and if different distros are using different old versions so much the worse). The problem is if it is something that other packages depend on and you end up in a hell of many twisty interfaces all different.

I wouldnt support packages in stable that cannot guarantee to keep their interfaces stable for a reasonable period. They could be available as addons with no guarantees of secutity fixes.

I think the situation is a bit better than it was as interfaces in things like gnome stabilise and people work out how to manage very big very distributed projects like that.

Re:Too many packages?

[kaarlov]

And most of those packages are for eleven different architectures. Yes, I know that they don't neccessary wait ARM-version to compile before releasing the fix for i386, but it still adds lots of work to testing.

And many of those packages are not really supported by anyone. And there is no good way to track, what is the status of support in packages you are using. Of course you can check a bug database, and if you find security bug filed and not fixed in six months or more, you can draw your own conclusions.

The current situation, however, can be taken care of by making sure that there are enough trusted people authorized to issue security fixes as soon as they are fixed and tested.

There was a discussion a while ago about dropping some of the architectures to "second class". I don't know what was the result of it (if anything) but maybe they should divide the packages into two groups as well. It could be helpful for the release process as well, and if there were smaller number of "premium" packages which are more or less guaranteed to be actively maintained, it would help users to assess the security status of their Debian installations more easily.

Re:Too many packages?

[slavemowgli]

The idea, I think, is that new versions of a program might introduce behaviour changes that you don't want to force on people running production systems and just updating packages to fix security holes - so yes, that's what I'd say "stable" means. It not only tells you that the software is (supposedly) tested and tried, but also that you will not get unrelated changes even when you update within that branch.

This is why projects will often release updates to older branches when a security hole is found, too.

Re:Too many packages?

[arivanov]

That is not the problem. Problem is elsewhere.

Redhat supports x86, x86_64, i64 and some power and zSeries stuff. Compared to that Debian supports Alpha, ARM, HP PA-RISC, Intel x86, Intel IA-64, Motorola 680x0, MIPS, MIPS (DEC), PowerPC, IBM S/390, SPARC. It also has the outrageously silly policy of trying to release updates for all of them at the same time.

Frankly, all the "problematic" architectures for which there are build problems are "security through obscurity" by themselves. If an update for them is delayed by up to 2 weeks it is usually a "Who cares, only two living people know how to write an exploit for this platform anyway".

Re:Too many packages?

[Just Some Guy]

At this second, FreeBSD's ports collection has 13127 entries, which probably puts it close to Debian's equal by the time you weed out multiple versions of Debian packages. Is FreeBSD having the same problems, or are they handling the situation, or are they just ignoring it?

Re:Too many packages?

[CAPSLOCK2000]

You shouldn't read stable as in "doesn't crash" but as in "doesn't change".
A newer upstream version may be very different from the older version, eg by having a different format for the configuration file. This is a pure nightmare for system administrators.
Debian's way of doing stable is one of the reasons why the corporate world likes it so much.

Re:Too many packages?

[lakeland]

Consider a situation where a server has been set up and is running well in a company. That server has been working for several years, and while it may not have whiz-bang features, it keeps working every day just as well as it did the day before -- nothing ever breaks.

Now, if a security issue is discovered in a package running on that machine, they do not want to upgrade to the latest release because they would worry about what it changes -- they want that one issue fixed and everything else to continue the same as before. Debian Stable is designed for people like this, the joke at the end of your post was actually close to the truth -- people really do want debian stable to be stable feature wise.

Consider another situation, where somebody wants a fairly reliable and a fairly up-to-date server. When a bug is discovered, and especially security-related bugs, they'd like an updated package. On the other hand, they don't want to be sent the latest buggy software, they'd like it restricted to software that appears pretty stable. Debian Testing is designed for people like this.

It sounds from your post that you cannot imagine people preferring a quirky, somewhat old, consistant distro over one kept up to date with bug fixes. I assure you that there is a large market for the stable distro, but if you are not in that market, there are plenty of others available.

Re:Too many packages?

[slavemowgli]

True. :) But it should be said that if you go beyond the basic system and add packages, OpenBSD can suffer from the same problem - packages *do* get fixed when security holes are found, of course, but they're not generally taken as seriously as the base system.

Of course, the fact that there *is* a base system that does not come in the form of packages (in the sense of pkg_addable ones, that is - the base system tarballs don't count as packages in that regard) is one thing that sets OpenBSD (and, from what I gather, *BSD in general) apart from Linux distros. Debian would probably be well-advised to adopt a similar policy, where more important packages get priority, if they don't have one in place already.

Re:Too many packages?

[sneakers563]

the joke at the end of your post was actually close to the truth -- people really do want debian stable to be stable feature wise

Actually, I wasn't joking, I wasn't sure if that was really the goal of stable or not.

Granted, I haven't poked around the Debian website in a while, but it seems like they could do a little better job of explaining that. It was always my impression that you didn't get security updates with 'testing' and 'unstable'. Perhaps they should make more of a point of stating that you do, in fact, get security updates with testing and unstable, perhaps even sooner than in stable, but that the behavior/features of the program may change.

Anyway, sorry if I seem totally clueless. I've never really seen anyone explain the stable feature set vs. "no crashes" distinction before.

Re:Too many packages?

[ArmorFiend]

My impression is they just ignore it. But then, I'm just a noob.

But their package compilation system looks a lot like:


tar -zxf foo.tar.gz
cd foo
make
make-install

That doesn't seem like a distribution-maintained package at all.

Re:Too many packages?

[Just Some Guy]

But their package compilation system looks a lot like:

They make quite a few binary packages available.

That doesn't seem like a distribution-maintained package at all.

Is there a fundamental difference between providing a binary archive, and distributing the tools for users to automatically create exact copies of that archive?

Re:Too many packages?

[lakeland]

It was always my impression that you didn't get security updates with 'testing' and 'unstable

This is (technically) correct. However, whenever a security bug is discovered in an unstable package, the uploaded version fixing it (usually just upgrading to the very latest package) is installed within a day -- some of the nomal double checking is bypassed for speed. Since fixing security bugs in unstable is so much easier than in stable, it happens quickly.

Similarly for testing, any bugfix that corrects a security update gets fast-tracked to testing and so is available within a couple days. There is even a process for making this faster if the vulnerability is spreading rapidly, but in general people don't seem to mind waiting 2-3 days for a security update.

Re:Too many packages?

[AuMatar]

The problem is that it takes a lot of effort to backport fixes. If an issue comes up and effects MyApp 1.0-5.0, chances are the fix I make to 5.0 does not work as-is for 1.0. So you need manpower not only to fix it, but to fix the fix. While there is a demand for such a distro, such a distro takes a lot of effort to maintain. The question is if the degree to which they do this is worth the cost. IMO, they go too far with it. But if thats how they want to spend their time, go for it.

Re:Too many packages?

[lakeland]

Yes, exactly. And that is why unstable is not showing any of the security problems that stable is despite there being no team to help with security patches in unstable.

Re:Too many packages?

[diegocgteleline.es]

if you look at debian security announcements you'll see that thye have 112 security announcements made in this year

That's one announcement every three days, more or less. And that's counting that those have been filed against the old debian stable (only more than 800 packages). With 14000, they're going to have more

But freebsd security team just cares about the "core" system packages not about the 13000 ports. So it's not the same, but you get the idea: The work behing the debian security team is HUGE

Re:Too many packages?

[cperciva]

Is FreeBSD having the same problems, or are they handling the situation, or are they just ignoring it?

The FreeBSD base system is supported quite well, although we have had occasional manpower problems (e.g., when one member of the security team is travelling around Japan on work, one member is writing his doctoral thesis, another member is job-hunting, et cetera).

The FreeBSD ports tree is supported on a "best effort" basis -- we make no guarantees, but we do our best.

Re:Too many packages?

[babbage]

Or is it when the Debian people say "stable", they mean a stable feature set and not necessarily stable security-wise?

I think that's precisely it.

I just left a job where all the Linux machines were running Debian Stable [Woody], unless there was a specific requirement for something else (e.g. a commercial application that wouldn't run reliably on anything but RHEL).

Everything was buggy as hell, but the admins were okay with this, because it was "stable". Desktop applications had thorougly well documented bugs or feature omissions that had been corrected upstream years ago, but if it wasn't available in stable (or maybe in backports.org, then an upgrade was strictly out of the question.

Therefore, I was constantly explaining to new people why CUPS crashed all the time, or why getting Gaim to connect to the Jabber server was such a convoluted process, or why we couldn't run Thunderbird or Firefox because the standard builds required a newer version of libc than what was locally available. Etc. Ad nauseam.

The logic for Debian stable comes really close to making sense, without ever quite working. You should be able to install the current Debian stable on a system, deploy it, and aside from occasional security patches, it'll always maintain the same state it was in the day you deployed it.... warts and all. And that's the catch -- there's lots of grimy old warts in a lot of the packages that had upstream fixes months or even years ago, but none of this is available to you unless you're willing to [a] build your own packages (and forego the wonder that is apt-get), or [b] upgrade to Testing or Unstable (and abandon the promise of stability & consistency, which isn't without merit).

Debian Stable is a great idea. It's disappointing that the reality of living with Debian doesn't live up to the naive promise of that idea. I can see where it's just the thing for a server that you want to set up and then ignore for a nice, long, mostly reliable decade, but for anything that you plan to put on your desk and have to cope with from day to day, it's just painful to live with.

Re:Too many packages?

[myowntrueself]

No, too many architectures.

They won't release a security update until they have it working across all architectures.

Given that some of them are for remarkably slow hardware, it can take a while to compile and test.

Hence, debian security releases happen at the speed of the slowest.

Not ideal really.

The sudo hole was reported and fixed in openbsd about two weeks before debian. In gentoo and ubuntu about one week before debian.

Re:Too many packages?

[poopdeville]

Yes. Downloading binaries is often much faster than compiling your own.

Re:Too many packages?

[ArmorFiend]

Again, I'm new in BSD-land, but my impression is that if I install a bzflag package (a game), there's not some hard-working bsd guru out there pouring over the sources to bzflag, looking for buffer overruns. I have been known to get Debian security alerts for games from time to time, from which I infer there is some Debian guru pouring over the sources looking for security holes. Obviously, Debian is way to huge for even an infinate number of these gurus to get this right, so they're necessarily going to stretch thin.

Re:Too many packages?

[0racle]

Its not outrageously silly. It might appear to be to someone who only runs one or two, (which is not necessarily you), but it makes complete sense to someone who runs several of them. It means that Debian is Debian no matter what system you run it on. I wouldn't have to think, ok which systems have a patch for exploit A, and which don't, I would know for everything before I started anything.

Re:Too many packages?

[arivanov]

Nope.

It is outrageously silly.

Ever tried to write shellcode for Alpha? It was even thought to be impossible for more then 5 years until someone published a way to do some limited borderline cases in 2000.

Ever tried to write shellcode for 680xx? Same as above, even harder due to the protection model vagaries.

Basically these arches use a different protection model and instruction encoding from x86. Both of these make writing shellcode nearly impossible.

So on, so fourth.

Re:Too many packages?

[paultt]

maybe. or maybe not, and remain the distro with the best package list at all. and not to going around searching for an application which a user can't compile, or rmpfinding it, and when found, boom! you try to install it and doesn't work.... one of the thing that make debian great is apt-get install whateveryouwantthathaveafreelicense :-)))) enjoy, i say. this is the way, i say too up debian!

Re:Too many packages?

[Just Some Guy]

I have been known to get Debian security alerts for games from time to time, from which I infer there is some Debian guru pouring over the sources looking for security holes.

I get those too, but I don't think that many of them originate from the Debian folks. For example, I did a quick search of their bugs database to get a list of severe security issues. The first link I clicked starts with a URL pointing to a description of the problem posted at gentoo.org. That's not to say that the Debian security team doesn't audit software - I don't know that they do, but they very well might - but they certainly pull in external reports, too.

Side note: I'm not an expert at using the Debian bugtracker, so my search was almost certainly suboptimal. I just went with the first try that gave a few results.

Re:Too many packages?

[daxomatic]

Plus the fact that they split up packages and then also with different versioning, for example ssh or ssh with krb5, not to mention that they are old packages.... I used to be a sysadm working on debian servers and the main thing i missed was the flexibility I have with gentoo, 1 package multible USE flags so i can choose what i need, not the way debian does it. maybe apt-get needs a revisioning or replacement so the list can shrink , less packages more resources more choice for the people, and oh it came not as a suprise. due to policy's on patching ( apt-get can break things! ) 4 hacks in 3 months then i decided I had enough...

Re:Too many packages?

[sneakers563]

Thanks for the info. Had I known all this a few months ago I would have gone with Debian for our office server. I needed newer packages then what was in stable *and* security updates, and didn't think I could get both.

I also wanted the root partition on a software raid, which seemed to involve jumping through a lot of hoops with Debian, but that's another story.

Re:Too many packages?

[petermgreen]

note: you don't have to forgo apt-get just because you build your own pakages

just set up a local repositry add it to your systems sources.list files and put any locally built packages there.

it is however true that woody was getting rather long in the tooth before sarge was released hopefully that won't be the case again with etch.

Re:Too many packages?

[petermgreen]

you got any links for info on this fast track system for getting security updates into testing?

and can dependency issues caused by building against versions of shared libraries from unstable prevent security updates from being fast tracked into testing?

Re:I ditched debian over the weekend

[winkydink]

I'm sure the learning curve of swithing from linux to Solaris is a bit steeper than one linuz variant to another, though may be mistaken. Also, this system is a dual P3-600. How's Solaris 10 run on 5-yr old hw?

hobbyist OS?

[OffTheLip]

Not to start a flamewar (well maybe a little) - OSS will need to meet the challenge of managing all of the little details of a widely acceted OS. Red Hat is grapling with that problem now with some suceess. Having what you believe to be a better widget is not enough.

Bits of News

[Masq666]

I originally posted this on http://bitsofnews.com/ but decided to post it on Slashdot also. It's a bit sad though that Debian is struggling with it's security updates, Debian used to be a nice distro but i've changed to Suse myself due to the lack og updates.

Re:Bits of News

[stevey]

So lets get this straight you've entirely switched to a new distro because security updates have been struggling for all of three weeks?

And worse you've switched to a Distro like SuSE which isn't the most timely releaser?

This is why things don't get fixed .. too many people complain, and jump ship, without offering to help.

Let it go Louie

[inherent monkey love]

Yes, Debian was *the* technically superior linux distribution for a long time. Those days are pretty much over folks. In fact, I'm surprised that the "BSD is dead" crowd doesn't have a similar mantra for Debian.

There are plenty of well-managed, technically sweet linux distributions out there. Some of them even use apt as their package manager. Let's just agree to learn from what Debian was, and move on to something better. I'll leave the holy war of what "something better" is to the rest of the zealots.

Re:Let it go Louie

[Ingolfke]

Ah yes, it sounds like Debian has followed Gentoo and BSD down the bath to oblivion.

Re:Let it go Louie

[Approaching.sanity]

Why makes you say that Gentoo is dead?

Re:Let it go Louie

[say]

Bullshit. All the technically sweet linux distributions out there which use apt are more or less resting on debian's shoulders. If you watch the security changelogs - or the regular changelogs - of ubuntu packages, you'll see that nine out of ten get made by debian, adapted to ubuntu and thrown to the ubuntu servers. Some are just renamed to "-ubuntu" and passed on. And a very few are actually maintained by ubuntu themselves.

We can't move on. Much of the linux community depends on a well-functioning debian organization. They are lacking man-power to keep their security updates as fast as the multi-employee-distributions. That doesn't mean they're technically behind, and that we have something better to move to. Although the commercial distros would love that.

Re:Let it go Louie

[WryCoder]

To say nothing of the fact that Ubuntu raided many key developers from Debian, which is now left scraping for help. Ubuntu is slightly repackaging the work of the real packagers, the Debian people, and calling it a new distro. It's basically a hostile fork, and we are the worse for it.

Re:Let it go Louie

[Ingolfke]

It's the somewhat-obscure "Gentoo and BSD on the road to oblvion" troll pattern. It's sort of a refactoring of the BSD is dead troll, but updated for Gentoo-fanboys and the modern age in general (the BSD is dead troll is so 1997).

Re:Let it go Louie

[natrius]

If you watch the security changelogs - or the regular changelogs - of ubuntu packages, you'll see that nine out of ten get made by debian, adapted to ubuntu and thrown to the ubuntu servers. Some are just renamed to "-ubuntu" and passed on. And a very few are actually maintained by ubuntu themselves.

Or you could just look on Ubuntu's web page on the matter. It's no secret that without Debian, there would be no Ubuntu.

Re:Let it go Louie

[WryCoder]

You are right, of course. Debian went too long between releases, and didn't provide the social means to correct the situation. That left an opening. However, one can fault the Ubuntu crowd for taking advantage of the situation instead of fixing Debian. Especially since they are doing it for profit on the backs of the remaining Debian packagers. Well, let's see what happens :-)

Re:Let it go Louie

[poofyhairguy82]

To say nothing of the fact that Ubuntu raided many key developers from Debian, which is now left scraping for help.

Yep...Ubuntu gave them good jobs...what an evil thing.

buntu is slightly repackaging the work of the real packagers, the Debian people, and calling it a new distro.

Plus stuff like new Xorg, Mono, and Gnome before Sid get it. Thats easy to forget though.

It's basically a hostile fork, and we are the worse for it.

I disagree.

Re:Let it go Louie

[petermgreen]

having hung arround #ubuntu-motu on freenode i'd hardly call it a hostile fork. actully for the non-core stuff they tend to preffer to go via debian with updates rather than update directly themselves.

ubuntu seem to basically be a combination of polish up and alternative release process for debian

Debian alternatives?

[RelliK]

So, if you've used Debian before and then migrated to something else, do tell. Is there anything that compares to apt-get? (no, urpmi is NOT it).

Re:Debian alternatives?

[BrianHursey]

I went from using debian for 3 years to gentoo this past winter.. I like portage. It is not as fast as apt but you get all your programs compiled specifically for your system. For me with an older laptop that makes life much easier.

Re:Debian alternatives?

[Anonymous Coward]

I tried Fedora with yum and it was surprisingly good. However, Ubuntu and apt-get has been great and that's what I've been using lately.

Re:Debian alternatives?

[Ingolfke]

I use this and this and it works like a charm.

Re:Debian alternatives?

[Chmarr]

'yum update' (for RPM-style distributions) works very nicely, thank you.

However, while it does feel like a 'front end to rpm' much more than apt-get feels like a front end to dpkg... that's just fine by me. I LIKE things that are distinctly layered

Re:Debian alternatives?

[swv3752]

Mandrake/Mandriva with urpmi.

RPM is a technicaly better package manager than dpkg. With the sources list updated, there have been no dependancy hell problems. It automatically download and installs packages and thier dependancies. It works better than YUM, works better and quicker than portage, and is at least as good (many ways superior but only because a better maintained servers list) as apt-rpm.

Re:Debian alternatives?

[tulsadsl]

I too have gone the Ubuntu route, and I'm quite happy with it. I take that back, I'm frankly ecstatic about it. I've spent most of my life on Windows, but moving a couple of my servers to Ubuntu has saved me a ton of headaches, not to mention It's helped me touch up some skills.

Re:Debian alternatives?

[KenFury]

I have used Debian since 2000 or so and have slowly been moving boxes to freebsd for the last 6 months or so. It was everything I loved in Debian, files are put in sane places, stable, not bleeding edge but current enough. It also had a good sized community that in a lot of way reminds me of debian. And going to your question it had a package management system that actualy works. Since freeBSD had come out with the 6-current series it even had a "Sid".

Re:Debian alternatives?

[Just Some Guy]

I'm also in the moved-to-Gentoo camp, although I also use FreeBSD in a lot of places (including several desktops). I guess I like the extra configurability of source-based systems over binary Linux distros.

For example, Debian currently lets me choose between "openssh-client" version 4.1p1-4, or "ssh-krb5" version 3.8.1p1-8; I have to pick between a recent version or Kerberos support.

I still like Debian and its derivatives, but I decided that it imposed constraints that I was not personally willing to work under.

Don't even get me started on the unavailability of X.org and KDE 3.4. Although there's nothing about source-based system that makes them inherently more up-to-date, it seems like the big names (FreeBSD and Gentoo) seem to do a better job of it than the binary distros have been able to manage. Perhaps there's something to be said for supporting a relatively small number of hardware platforms. Gentoo even supports platform-specific versioning, so x86 users can play with the latest and greatest apps, even if they don't build on m68k.

To each his own, of course. Those are the reasons I made my decision, but I'm sure they're far from universal.

Re:Debian alternatives?

[snorklewacker]

Ubuntu takes debian's "no patches except for security, EVER" as well, and then still expects to have a desktop system that end-users will want to use.

As long as you don't use firefox. The only way to get any extensions or themes with Ubuntu's version of Firefox is to go into about:config and manually edit the vendor_sub version string yourself. Ubuntu can't be bothered to do this because, well, it could constitute a patch. Their answer is to wait 4 months or so for Breezy, which will then have its own updated snapshot that will then never have anything upgraded that isn't strictly security-related.

I find this inflexible adherence to procedure simply mindless. I would prefer a distribution that's stable because maintainers actually exercise good judgement.

Re:Debian alternatives?

[ScrewMaster]

Are you a troll? Because, if I recall correctly, trolls have layers.

Re:Debian alternatives?

[say]

I find it very appealing. Have your computer just like it is for 6 months, then get a "freshening up", and then have it like that for another 6 months. No trouble in between. The firefox issue is annoying, though, and I think they won't do things like that again.

Re:Debian alternatives?

[feronti]

No, those are ogres.

Re:Debian alternatives?

[Halvy]

i notice noone responded to your question *yet* so i'll give me .02 worth.

nothing *compares*, but you have to compare apples with apples.

and since debian is well, only debian, i can only add that Synaptic (graphical front end) for apt-get is alot easier to use when you want to install or change alot of programs.

I also notice quite a few of the *other* distros are implementing apt-get/synaptic with their releases, in addition to whatever else they would normaly have as default (ie urpmi, Kpackage, etc). :)

Re:Debian alternatives?

[ScrewMaster]

Ah. Right. Sorry. Been a while since I saw Shrek.

Re:Debian alternatives?

[ChrTssu]

I like it as well. I think it's a great idea to put out major changes, take a step back and allow users and developers to "have at it," as it were. Then take everything you've learned and start the whole process over anew. And I haven't had a bug yet that hadn't already been documented and a workaround or fix provided.

Re:Debian alternatives?

[feronti]

It was still amusing, though:)

Re:Debian alternatives?

[poofyhairguy82]

Umm...the developers didn't want to support the new packages. Its a smart decision, those new packages might bring bugs and mess up a done deal. They are still easily availible. I have never had a stability problem using Ubuntu Backports. The person that runs it is really nice and picky about bugs...

Re:Debian alternatives?

[Golradir]

Have you ever tried http://www.archlinux.org/? It's got an excellent package manager called pacman.

Re:Debian alternatives?

[Just Some Guy]

Since freeBSD had come out with the 6-current series it even had a "Sid".

-CURRENT has always been Sid, perhaps even before Sid existed. I remembering playing with 4-CURRENT back when I first installed 3.2.

Re:Debian alternatives?

[KenFury]

I should have been more clear. I am aware that Current is always been sid. IIRC there was a short period where I could not find a 6 series. It was around 4.10 and 5.0 were both coming out. I was trying to draw attention to that fact. Perhaps I should get more sleep before posting.

Re:I ditched debian over the weekend

[Linker3000]

Darn, that even beats my Dual PIII-450 running CentOS3 (going to CentOS4 tomorrow)

Current issues

[cortana]

http://newraff.debian.org/~joeyh/stable-security.h tml is an incomplete list of issues currently affecting stable. It's not 100% correct; in addition to the provisos at the top of the page, it doesn't seem to know about recent updates such as this morning's Gaim update.

Re:The most secure option

[plasticsquirrel]

but if that is not possible, why not fly to the middle of the sahara with a laptop, solar panel and gear, and just do your buisness there. No worry about hackers, or physical attacks.

How is this even relevant to an article about the difficulties the Debian people are having with their security approach? Not only is what you suggest off-topic, but it is ridiculous. Most companies are interested in still having useful computers while keeping a sane security model.

Personally, I have noticed that as distributions get larger, they also get harder to maintain and more difficult to change, as more people are required for the basic maintenance of the software. On the other hand, more compact Linux/BSD distributions are often known for their security and stability (OpenBSD, Slackware, NetBSD). I hope that the Debian people can get the distro back on track and manageable again.

But people's resumes!

[Eunuch]

People need these packages in Debian to help their career! They wrote something primarily to get a job. Suddenly a bunch of resumes are outdated. Jobs, jobs, jobs!!!

Is unstable possibly better?

[sneakers563]

I wonder, if unstable get's the "latest and greatest", so to speak, are there times that it gets security fixes before "stable"? The article mentions that Gentoo got a fix before Debian, presumably when it was fixed upstream. Did Debian unstable get the fix at the same time?

Re:Is unstable possibly better?

[kaarlov]

I don't know about recent issues, but for last year or even two years of Woody being stable version, there were many security problems in Woody which were resolved very slowly or not at all, while the unstable was usually fixed in reasonable time.

Of course, unstable is what it says. You get new features, different behavior and even broken software all the time. Not very good thing in production enviroment. And right now there's some major changes going on in the unstable (C++ ABI and Xorg transition) and I would be extremely cautios using it. But if the release of Etch takes as long as Sarge, the unstable will be the way to go again in 2007 at the latest.

Re:Is unstable possibly better?

[poopdeville]

Yes, there are times when Unstable gets fixed faster than Stable. The way the whole Stable/Testing/Unstable thing works is that a package maintainer submits a package to Debian. It is placed in unstable. If it survives two weeks there, it is moved to testing. Eventually, there is a freeze and all of testing becomes stable. Now, if a bug is found in a testing package, a new package is submitted to Debian to replace it. So it ends up in Unstable for two weeks. Packages can be fast tracked from Unstable to Testing if the issue is severe.

Regarding whether Unstable got a fix at the same time as Gentoo, that depends on whether or not the package maintainer is following the source as closely as Gentoo. In theory, there should be no difference.

Ubuntu

[Apreche]

This is at least partially because the attention that Ubuntu is getting. And rightfully so. IMHO in most situations today, especially desktop situations, an Ubuntu install is vastly preferred to a Debian install. It is the same Debian quality you are used to while simultaneously being even easier than Fedora.

I'm not saying kill Debian, everyone bail to Ubuntu. I'm saying that there is competition for manpower in the open source world. And in a capitalistic/darwinistic manner it's going to be the fittest that survive. And if another project takes your manpower away because it is better in some aspects, then that is what will happen.

I've used Debian and I've used Ubuntu. And I can say that I no longer find much reason to use Debian anymore at all. This story doesn't surprise me in the least.

Re:Ubuntu

[Anonymous Coward]

A thing you should know about Ubuntu is that about 95% of the software in Ubuntu comes directly from Debian since they get regularly resynced with debian. Bascially Ubuntu would be nowhere without Debian. Also alot of the Ubuntu developers contribute to Debian.

Re:The most secure option

[Metteyya]

Actually, being American on Sahara (and whole muslim-dominated north Africa) makes you pretty prone to physical attacks :).

Security support is ill-suited to open source

[cperciva]

Woah! Wait a moment before you start flaming me on the basis of my subject line...

The problem of providing security support is ill-suited to being solved by the traditional "mob of volunteers" approach which describes most open source development. When you're doing development, it doesn't matter if you have five people coding one week and nobody doing any coding the next week; but when it comes to dealing with a constant stream of security issues which are being reported (in particular, from upstream vendors), it is important to guarantee that there will be someone around to deal with them. When the entire security team consists of people who have other full-time jobs, it's impossible to make sure that someone will be around when they are needed.

The job of "security officer" is really one which should be a job, not a role-played-by-a-volunteer. Go out and raise some money to pay for your security officer, so that he is able to always be available when he is needed, because if he needs to get some other job to support himself, he won't be around when you need him.

Build dependencies change

[coyote-san]

I've built my own "unstable on stable libc/perl" packages and after a while dependencies will kill you. The latest version of a package requires A, A requires B, B requires C, and the new version of C breaks a lot of things.

Security backports require more effort, but they're unlikely to trigger cascading updates.

*BSD.

[MrDomino]

All of the BSDs currently have excellent package-management systems that can elegantly handle both binary and source packages. pkgsrc in particular is a really nice system---further, it has the advantage of not being tied to one OS. Although it is developed primarily for NetBSD, it can be used from any of the other BSDs, Linux, several Unices, and even Windows (with Internix, i.e. Windows Services for Unix).

In fact, it's definitely worth checking NetBSD out; the 2.x line has been really interesting, and development is continuing to move forward at a rapid pace. If you're on a single-processor system, it's arguably one of the best-performing OSes available at the moment, and it in general will work. Add that to the fact that you could probably port it to your toaster if you were dedicated enough, and it's worth giving serious consideration to as an alternative to Debian, or indeed anything else.

Security woes?

[JPortal]

I've always thought (because people have informed me) that Debian is the most secure distro... what went wrong?

Re:Security woes?

[zootm]

Read the article for the answer to this question, my son.

Re:Security woes?

[Cro Magnon]

There's an article here? :O

Build systems shouldn't be an issue...

[Junta]

While not personally familiar with how the builds in Debian happen, a cross compiling build system is how a lot of vendors deal with this very issue.

I know of vendors that support equipment they don't have a single sample of. Of course, they warn their customers and typically have one or a very small number of early-adopter customers who maybe get a good price break or simply want new features enough to explicitly desire bleeding edge to serve as testing for their releases.

Re:Close: Switch to OS X

[cwalker]

I thought that this sub-thread was so stupid that it was not worthy of a response but this list of incredible flaws in Linux that are supposedly fixed in OS X or Windows is so ridiculous, I just had to respond.
1. More secure? Not true. All Operating Systems have problems, closed sources Operating Systems have more problems than others becuase there are fewer people viewing and fixing the bugs and other problems. An Operating System's security depends greatly on the configuration and administration not that is is created or modified by a certain company.
2. Not true either. Speed depends on configuration and administration. Mac's are tuned for certain things where Linux can be tuned in any cofiguration you so desire.
3. More advanced or aged only because it is running a version of FreeBSD which is so close to linux how can you call it anything but *NIX?
4. Built for idiots that rather the computer maintain control. I, on the otherhand, like to control my computer.
5. Linux is backed by many successful companies such as IBM, Novell, Redhat, etc., etc as well as a world of seasoned programmers.
6. See above. Open source programming does not mean amateurs. Most of the open source programmers are seasoned vets that work full time for large companies.
7. Most of OS X is open source because it is Free BSD. Note the "Free" part of that. (see http://www.freebsd.org/copyright/copyright.html)
7. (you probably meant 8 right?) See above statements. OS X is mostly FreeBSD which means they do not own the code. The GUI, they own, but so what. The kernel is still UNIX!

If the list goes on I would like to see it because this preliminary list is bogus.

Debian (and it's decline)

[cute-boy]

To keep such a large and sprawling project active requires huge volunteer resources, which obviously simply isn't available, no matter how much rhetoric we write here.

Maybe Debian distribution is simply being susperceded by others who do better on some of theses things, in which case, it will (must) either adapt or for face further decline.

That is a natural process of evolution. Look at some of it's wonderful spin offs, such as Umbunto (now how easy is that to get going, get it's based around Debian).

-Richard

Re:Debian (and it's decline)

[eneville]

what a load of trash.

debian is not in a decline, they just need to slow the package release cycle, the greater number of times packages are released during a month increases the amount of checking required.

The whole point of stable/testing/unstable is so that the packages filter to stable slowly.

quit your whining.

I'm having with phrase composition.

[TheLittleJetson]

Sorry to make yet another jab at the editors, but it needed to be done.

Almost

[trezor]

More like:

cd /usr/ports/typeofprogram/name
make
make install

And after you install CVS to update your ports tree you get the newer versions. Granted, it's not releasing fixes for the old ones, but saying there is no consistent way of doing stuff in FreeBSD is just flat out wrong.

s/800/8000/

[diegocgteleline.es]

s/800/8000/

your not only a coward, but an..

[Halvy]

asshat as well.

if linux users got what they paid for, they'd get nothing, you.. you..you bill hates follower.

I'd rather pay nothing, take that money and either put it towards a hardware router for security (just plug it in).. or save that money for something else fun..and set up a linux software firewall/router (easy, just point&click).

If people didn't have windoz forced on them when they buy in major oulets, they would get used to linux quicker.

at least with linux, when you put the effort into fixing it the way you want (note: linux at least has that option!), then we have a functional & hardened box.

I hope I didn't use tooo many big words there, mr coward :)

Re:The most secure option

[hilaryduff]

i dont think that's true

A lot of assumptions for a page and a half article

[atokata]

The article didn't go quite as in depth as I would have liked. Specifically, the Debian apt repositories have literally, and you may quote me, zillions* of packages. I'm fairly certain they have quite a few more than, say, Red Hat has binary packages in their repositories.

Therefore, it would follow that if 4% of Debian packages had security vulnerabilities that would equate to a substantially greater number of packages than would the same 4% of Red Hat packages.

The other important thing to keep in mind is that it's unlikely many users would install all zillion packages at one time.

Finally, the article implies Debian and Red Hat are in competition. However, as literate geeks will know, Debian is the OS of "Software in the Public Interest" http://www.spi-inc.org/about which is a non-profit entity. Therefore, while one could argue that Red Hat (a for-profit enterprise) and Debian are in competition for userbase, by no means are they in direct competition for 'business'.



*Debian website says "over 15490." Which begs the question, how many more than 15490? 15491?

I'm increasingly concluding

[mcc]

If in order to make whatever your point is, you have to make up hypothetical opinions held by people you also made up under a hypothetical situation you also made up...

You don't actually have a point at all.

You Sir Are A..

[Halvy]

Pathological Lier!!

You do know that there is help out there for you?

It's called Open Software, and it allows you to modify your own OS-- if some other hacker/programmer hasn't gotten around to doing it for you yet!!

You NO LONGER need to wait for bill hates to NOT GET AROUND to it-- at all!!

Yes, it is true..

see.. you'll be ok. :)

Re:Close: Switch to OS X

[CyberDave]

OS X is mostly FreeBSD which means they do not own the code. The GUI, they own, but so what. The kernel is still UNIX!

No, not really. The kernel is Apple's own creation (Xnu, I think they call it, but I'm not positive on that). As I recall, it's a Mach-derived kernel. The user-space is all FreeBSD-based, but the core microkernel is not.

And Apple owns more than just the GUI. They own the APIs, too. You know, CoreFoundation, Cocoa, Carbon, all those fancy things that allow Mac developers to quickly and easily make all those wonderful programs.

Mac OS X is far, far more than simply FreeBSD with a proprietary window server...

I kind of saw this coming...

[Hosiah]

I know I'll get flamed all over Christmas by Debian die-hards about it, but oh well.

I tried Debian for the first time as soon as Sarge 3.1 went to stable. I've tried about ten Linux distros (ranging from popular installs like Red Hat and Slackware, to live distros like Knoppix, and even floppy-based like Tom's root-boot and Hal91), and sorry to have to say it, but every other Linux I've ever worked with combined didn't give me as much trouble as Debian. The whole thing left me with an impression of fantastic disorganisation. It was just a shambles! And I might not be so quick to lay blame, but other distros manage with a handful of maintainers releasing every six months, and they get their act together better than Debian, which brags about their "hundreds of developers worldwide" and had a leisurely THREE YEARS to release the new version. I bet they're plagued with all *sorts* of problems, but at least some good Debian-based distros come from the huge package archive.

No kidding, I've fooled around with building my own system from scratch a little, (nowhere near getting a whole major title together!) but enough to gain a basic understanding for how it's done. All it really takes to make your own Linux distro is fdisk and create some partitions, set up a few folders, get a few basic components installed from source compiled on a host system, and then just download tarballs and compile from source. Any Linux distro, logically, should be even LESS trouble to get going than it would be to do-it-yourself. I vowwed on my first Debian-day to conquor the difficulties and perhaps even contribute some small fixes when I get going. By the third Debian day, I looked at the whole mess and just shook my head and zeroed the drive. My effort is much better spent writing programs to enhance *other* distros, which aren't so bad off to start with. Of course, it would also be an easier job for me!

No, I don't hate Debian. I wanted like *damn* to experience the super-cool, ultimate-Linux, uber-geek joygasm that Debian fans have been selling me. I do, however, feel sorry for Debian, and hope it perhaps gets redone right from scratch? I can conceive of no other solution for it.

Re:I kind of saw this coming...

[shotwell]

If you think compiling from source is where the future is, I am truly sorry for you. The people at Debian have done some really good things, including apt and dpkg. Without these distribution tools for binary packages for Debian, Debian and its spinoffs would certainly be dead. Remember that the developers for Debian spend most of there time testing these packages and repackaging them into deb packages so no one HAS to compile from source. Also, Debian has spawned some great distros to follow in its footsteps that make the linux experience something that you can teach to your average computer user. If you take your time to learn more about Ubuntu you'll realize that there is another layer of package editing and testing between you and the Debian folks and perhaps you'll be convinced that the mess you talk about doesn't exist. Debian derivatives are some of the most prominent distros right now with Ubuntu having the most hits (and still rising) on http://www.distrowatch.com/. Give that a try before you write off Debian completely.

Re:I kind of saw this coming...

[elbarono]

I routinely hear comments like this from people who have never admined a box outside of their own bedroom. No, Debian is not the best desktop OS. Its strengths lie in security (despite the recent lapse for which there is a very *specific* reason), ease of administration, and stability. (not 'it never crashes' stability, but 'upgrades to stable revisions of software are pretty much guaranteed not to break stuff' stability, as opposed to other distros that have no problem, for example, changing the major version of libc in a point release.)

Re:I kind of saw this coming...

[stevey]

So you had "lots of problems", but you can't even name one?

I guess suggesting you report bugs would be redundent if you've wiped the install already - but Debian shouldn't give you more problems than any other distribution.

After all with a recent release of Fedora, etc, chances are the same package versions and kernel were installed.

Still I'm sure that with your indepth knowledge of having a broken system for three days your suggestion of redoing things from scratch will be taken on board by all Debian developers.

Sounds like you've hit on the perfect solution.... </irony>

Re:I kind of saw this coming...

[Hosiah]

So you had "lots of problems", but you can't even name one?

What would be the point of posting all 999,999 snivels on Slashdot?

After all with a recent release of Fedora, etc, chances are the same package versions and kernel were installed.

Nope, not correct at all. Fedora has something closer to modern programs written in this century. More so for Slackware, Mandrake, Knoppix, and Mepis, which is what I have currently running on all five hard drives of the three computers I currently run in the home. Other systems release with man pages for their package managers that say something besides "This man page isn't even written yet!" Other systems don't have 5% of their files as softlinks to other files, so you get a ton of dead-ends and tail-chases every time you try to find something! Happy now? It's better when I meticulously list every single gripe, isn't it? To the purpose of giving people who want to argue more things to argue about.

As for the other comments, it's funny how much I hear, "Well of COURSE you hated it, it's not for desktop use! It's a server system for admins only!" and "Well, duh, installing is a nightmare using the disks only on a machine that's not on the internet! You're only supposed to do it online, where apt can update live" or however it goes. You know where the right place would be to tell me all this? HERE:

http://www.debian.org/intro/about

In big capital letters at the top of the page. Quote: "DO NOT WASTE YOUR TIME DOWNLOADING AND BURNING 14 CDS TO INSTALL ON YOUR HOME COMPUTER, NO MATTER HOW MUCH OUR FANS CONVINCE YOU DOING SO IS THE ONLY POSSIBLE PASSAGE TO VALHALLA. THIS DISTRO IS JUST FOR GEORGE, SAM, AND ALICE. IT'S DELIBERATELY AIMED TO BE A FANTASTIC WASTE OF EVERYBODY ELSE'S TIME, AND TO MAKE A BAD NAME FOR LINUX ON THE HOME DESKTOP". Better than the song and dance I find on this page, now.

Pardon me for sounding so sarcastic. But, surely, through all the layers of smart-assery, I must make some token amount of sense? That was one of my chief gripes with Debian: It tells me it's going to kiss me, then kicks my ass over my shoulders, then says, "Of course I was going to kick you, you dumb ass, don't you know anything?" I get that from even the most incidentally-associated anything with Debian, just with Debian, and with nothing and nowhere else. Somehow, I have the feeling that the zillion other distros that include server installs and admin utilities would have *something* to offer, without this behavior?

All of which backs up my initial statement: "I am not surprised that Debian is having problems with security."

This time, BELIEVE ME when I say I could say a hell of a lot worse about Debian than I could already, here. I haven't scratched the surface of the iceburg, yet. I'm not holding back out of hiding something. I'm holding back out of a desire to not do any more harm to the distro than I have to, not to hurt any more feelings than I have to, and most especially because I hate shooting a dead horse.

Re:I kind of saw this coming...

[stevey]

I'm not holding back out of hiding something. I'm holding back out of a desire to not do any more harm to the distro than I have to

It sounds suprising to me that you'd have so many problems when many, many, other users are running Sarge without problems.

Instead it sounds more like you are trying to do harm to the distro by suggesting that it's so full of problems that you couldn't use it - without actually clarifying what they are.

Sure the distro has bugs, just like any other. But the Debian Developers generally care a lot about fixing them when they're reported.

Anybody who complains about a bug, on the other hand, without taking the time to report it I believe is wasting everybodies time.

(Not necessarily suggesting you're doing that).

Listing specific problems isn't going to make me argue more, it's going to show that you were actually being honest - and not just randomly spewing fud like so many other distro-bashers.

The symbolic links in Debian do have a purpose, for things like the alternatives system, etc. Although it's understandable that newcomers to the Debian way might not understand why they're there, etc.

As for pacakge managers all of dpkg, apt-get, and aptitude have manpages - so I'm not sure what you're meaning there.

I've probably not helped change your mind or anything, but at least it's clear to others now that you did have genuine problems..

Re:I kind of saw this coming...

[Hosiah]

Instead it sounds more like you are trying to do harm to the distro by suggesting that it's so full of problems that you couldn't use it - without actually clarifying what they are.

Oh, OK, you got me dead to rights! I'm pulling the whole thing out of my ass! That's why:

http://www.debianplanet.org/node.php?id=831 this unbiased review points out many of the same issues I had, and why:

http://eol.init1.nl/content/view/47/2/
this guy seemed to have an issue with it, and why: http://corelands.com/blog/?postid=4
this guy sees a problem, and why:

http://www.miketaylor.org.uk/tech/wxinmfpl/debian. html
This guy hits it on the head with why the whole apt system is screwed, and why:

http://www.debian.org/vote/2004/platforms/branden
this page of politics points to strife and
http://ianmurdock.com/?p=153
YOUR OWN FOUNDER EVEN SAYS THERE'S PROBLEMS COMPARED TO UBUNTU.

I especially like how you keep harping on reporting bugs through the proper channels. What, like you think I haven't tried? Then on that last link, Ian Murdock's weblog, I see: "One major difference between Debian and Ubuntu is that Debian users' imput is mostly ignored, whereas Ubuntu users are heard and respected." -quote, typos and all! So, tell me, "stevey", is that you deleting our input so that the PUBLIC NEVER SEES IT?

I'm hoping to God that this lying weasel I've been arguing with is somebody currently high up in the Debian chain of command. Because, to read Ian Murdock's weblog, this man [Ian] sounds like he originally founded a fantastic, kick-ass distro, which he then trusted to a pack of idiots who fouled it up, and he regrets it.

Until today, I thought somebody just must have been scarfing shrooms - how could a Linux Distro *possibly* be *this* *stinking* *bad*?!?!? But thank you, "stevey" for at last providing me with an explanation that approaches sense: Debian is deliberately being sabotaged from within. And it wouldn't surprise me a bit to find out that that sabotuer(s?) was paid by a commercial software company which views itself to be in competition. This isn't the only possible explanation, but by God it makes the most sense. And I was ready to let it go, before I met you. But I love a good mystery! So, yeah, I think I WILL dig deeper until I get to the bottom of this...lol...pile, whenever I get the free time.

People who really want to know every detail of what's going on when you stick Debian Sarge disk #1 in your machine and boot it can view all the complaints this guy claims I'm covering up, along with my aborted effort to write some kind of install guide for the home user (heck, I *did* get it installed, after all!), can find my report HERE:
http://aimlesslifehobbies.blogspot.com/

Re:I kind of saw this coming...

[autechre]

He may be refering to the "placeholder" man pages for some programs for which man pages are not available, but you're right; apt and dpkg have extensive man pages.

None of his experiences with Debian sound remotely similar to mine, and I've been using it for around 5 years (switched after 2 years of Red Hat). It's possible the whole rant was made up, but I try to give people more credit than that. Perhaps it can just be put down to different experience levels, expectations, etc. Obviously, Debian won't be for everyone.

(and yes, I run it on every machine, including both my desktops, the firewall [previously OpenBSD], servers that have been in use for years, etc.)

Re:I kind of saw this coming...

[shotwell]

Like I said before, if you want an easy to use desktop system...try Ubuntu. They release security fixes in a timely fashion and test the setups themselves. It really is easy to use and is worth your time. If you don't like Debian, please try Ubuntu or another offshoot of it because I think you will be much happier. On another note, anyone that said Debian was a "joy-gasm" probably also mentioned that it really is a difficult setup to use for home use. It really just wasn't designed with that in mind.

Re:I kind of saw this coming...

[Hosiah]

On another note, anyone that said Debian was a "joy-gasm" probably also mentioned that it really is a difficult setup to use for home use. It really just wasn't designed with that in mind.

In other words, I'm still a liar, is exactly and precisely what you mean to say.

Re:I kind of saw this coming...

[Hosiah]

It's possible the whole rant was made up,

Am I the only person here who can read? Yoo-hoo! The links I posted two posts back up this thread? I suppose I cleverly impersonated all those different people and made up all the stuff that's there, too? Oh, yeah, I must have hacked Ian Murdock's blog and put the words in his mouth - plus all the comments from all those different posters. And I suppose I faked the news article about Debian security problems and then impersonated frequent poster Zonk to be sure the story got maximum coverage. My, I must have been busy!

"And I would have gotten away with it, if it hadn't been for those nosy kids..."

None of his experiences with Debian sound remotely similar to mine, and I've been using it for around 5 years

Ah, yes, thank you, at least there's something that makes sense. You know, I've been hearing many such comments...but *only* from old-time Debian users of the Potato/Woody era. In fact, no less a respected figure than Neil Stephenson, in his essay:
http://www.cryptonomicon.com/beginning.html
has nothing but praise for Debian...but check the copyright date, circa 1999!

No, I have caught a whiff of an idea that whatever the hell (I do mean hell, demons, brimstone, and all!) happened to Debian, it was once much mightier than it is, now. But, as another /.er put it, "Oh how the mighty have fallen." And I indicated that I'd read something in the pages that my previous post links to, that sounded like (a) Debian is experiencing some deep political turmoil, i.e. head-to-head fights among developers, and (b) Mr. Murdock's post titled "Can't we all just get along?", seems a pretty clear indication that the Debian volunteers evidentally don't consider cooperation to be a chief utility of volunteering in the first place?

So far, this explanation holds water. Because, remember in my original attempt to gloss over the topic (that'll teach me to try to be nice!) I referred to it as "fantastic disorganization, just a shambles". Come to think of it, if a group that was teamed together on a distro had a big war over how to make it and couldn't put their differences aside long enough to at least do a decent enough job to save some face, it would look - not just almost - but EXACTLY like what Sarge 3.1 looked like!

Documents that pointed me to docs in other folders that didn't exist! Screens in the install program that contradicted each other! Three copies of a file under three different names here, ghost copies of files which were actually softlinks pointing to softlinks pointing to empty space there! Packages that installed all the supporting features without installing the base program itself! "Placeholder man pages" - oh, my ASS, placeholders, funny how I'm lying about something that turns out to not exist - yet, mysteriously, you actually have a name for it! What could be simpler to write than a man page? What, ten minutes, and run it through nroff? Three years wasn't enough time to do that? Show me ANY other operating system - Linux or not - that releases with blank doc pages ??? They must be damn rare, because I never saw any before or since. And you can shove "100% percent unpaid volunteers" up your wazoo! 90% of Linux is volun-fucking-teers, including the humble little amatuer programs I post myself in my blog, which even if they're PURE SHIT, have documentation in the form of comments in the source code!!! Anybody who has a man page to write that isn't done yet, I hope they weren't in places like Slashdot bitching about how hard they have to work and accusing everybody who says their work isn't done of lying!

Finally, there's that word "server" again. "It makes the world's best 14-CD server!!!" Ey, whatever floats your boat. Surprise, I've actually worked around a server or two in my time, my own self! And to me, a server was something that came on two floppy disks which you installed with about four commands on a plai

Re:I kind of saw this coming...

[Hosiah]

What???

A whole hour has crept by, and no more it's-not-a-dead-parrot, it's-just-pining-for-the-fjords buttwad excuses about Debian???

Jesus, I'm getting bored!

parent Flamebait

[Britz]

Parent post is a flamebait and I wonder what moderators are smoking today.
Debian is much more than a distribution. And there is unfortunately nothing better than Debian (as in the distro) to move on to. There is a reason why many distributions are build on Debian.
Please point me to a distro that can manage version upgrades even half as gracefully as Debian.
There was a discussion about Ubuntu on Slashdot and it was argued that if Ubuntu continues to be diverge further from sid and stay incompatible it will eventually dissolve, because the team will never be able to support the huge package base.

I am a desktop Linux user that started out with Debian 2.1 Slink and I also have the feeling that Debian has had some major issues lately.

About the security issue:
Heise security published it first 10 days ago:
http://www.heise.de/newsticker/meldung/61076

As a result of this a discussion on the Debian security mailing list ensued:
http://lists.debian.org/debian-security/2005/06/ms g00142.html

Heise Online then reported on that as a result of that discussion:
http://www.heise.de/newsticker/meldung/61125

For those that can't read German the article says that of the five members that should make up the security team four are not active at the moment if they ever were. The only remain one is Martin Schulze aka Joey. He has been pretty busy with the organisation of the Linuxtag. So he was cut off from the action. Debian people are working on the problem.

Everyone that is not satiesfied with the current state of affairs should get their hand dirty helping instead of complaining. After all Debian forms the bases of "plenty of well-managed, technically sweet linux distributions out there".

Like Knoppis, Ubuntu or Xandros. Full list here:
http://www.debian.org/misc/children-distros

Re:parent Flamebait

[WilliamSChips]

Please point me to a distro that can manage version upgrades even half as gracefully as Debian.

Gentoo.
There's no difference between different versions of Gentoo after they've been installed. Which means there's no need to even do version upgrades.

I dunno know, ..

[Halvy]

why don't you tell us?

I'd say they have the same problems.. if not more. If I'm not mistaken, the freebsd project is headed by one person, and much less volunteers than deb.

Considering sooo many distros are eating-off deb with very little in return, i'm suprised deb is still alive.

However, everything IS working out as planned, as can be attested to by the growth of distros and users in the linux/unices communities.

Here's why your wrong

[bogie]

"When the entire security team consists of people who have other full-time jobs, it's impossible to make sure that someone will be around when they are needed."

Your wrongly basing your entire arguement on the idea that OSS programmer(s)=loner(s) with other "real" jobs. That is simply not the case for many OSS projects. Commercial OSS companies like Red Hat, Suse/Novell, et al are and have been the driving force in OSS for some time now. Look at any big distro, any major software project etc and at this point chances are they are being bankrolled and supported by commercial copanies that are paying people to work on them and deal with things like security issues. And if a popular project has a security flaw that an author won't address, and distros won't fix because its not part of their distro...well you know the deal, use the source luke.

I see what your trying to say but again your arguement is flawed as "traditional" OSS development no longer means unpaid and non-commercial. I don't think that the people buying Red Hat linux and getting security support for years and years would share the same viewpoint. And I also don't think that commercial companies put more into security than OSS programmers do. History just doesn't show that.

For version .002 for widget X that isn't widely used and gets abandoned for lack of interest and now has a security issue, how is that different than in the commercial world? At least with OSS someone/anyone can fix the problem. With commercial software you literally have to stop using the software because no fix will ever come.

OSS is particulary well suited to dealing with security issues IMHO and the problems it has with security are more or less the same problems that commercial software makers face. Your floating down a well known river in Egypt if you think that in the commercial world all projects have people who are paid to soley to work on security.

Re:Close: Switch to OS X

[westlake]

1 ...closed sources Operating Systems have more problems than others becuase there are fewer people viewing and fixing the bugs and other problems...

The lead post is titled "Debian Struggling With Security," in part because the Debian team is short-handed.
There are 200 or so Linux distros. But Open Source doesn't magically endow you with the organization, money and manpower needed to maintain any one of them.

4. Built for idiots that rather the computer maintain control. I, on the otherhand, like to control my computer.

George Eastman had a slogan: "You click the button, we do the rest." Once a technology becomes accessible to the masses, the hobbyist and his obsessions are driven to the margins. Calling your opponents idiots doesn't change a damn thing.

Re:Close: Switch to OS X

[zootm]

The GUI, they own, but so what. The kernel is still UNIX!

So they made an OS usable by non-geeks. Stop whining and get a girlfriend, or next you'll be whining that the command line should come back.

Re:A lot of assumptions for a page and a half arti

[rbanffy]

Slightly less than 15500

Re:It seems as if

[Brian4120]

i am not suprised. not supirised at all

Maybe just need for some minor change

[kandresen]

Quote from the original article:

--
As one developer put it: "The problem we're currently seeing isn't that the job is hard, but that only a very small number of people have the authority/ability to push the update out."

Another agreed, calling for the size of the security team to be increased from seven to 21.
--

So maybe it is not about the amount of people who contribute updates and patches, but rather the amount of people with authority to revise and release the patches and updates.

Re:your not only a coward, but an..

[Halvy]

LOL!!

Gee, i wonder who YOU work for!! LOL still!!

Linux is based on the OS that built the worlds phone-nets and later on, InterNet. Your going to compare THAT with Ms. !!

if *Ms.* (pronounced: mizz) released it's code, it would become a much better program because people who WANTED to work/fix it, would, instead of those who HAVE TO.

And ask anyone over the last 40+ years, if the money spent on the wars on: Drugs, Crime or Poverty has detered those problems.

I do stand corrected on one thing though, Sir..

You are NOT an *asshat*...

Buhhhhhht, you are an...

ASSWHOLE!! LOL!! :)

fallacious causality

[doubledoh]

Perhaps that's because the "vast majortiy" of computers run closed source software. As soon as 95% of the world uses open source operating systems, then we'll start comparing security.

Re:welp..

[ShieldW0lf]

It's not like walking up to some stranger on the street and asking for uninterrupted charity work. It's more like mounting a sign in every computer store asking "Got any code kicking around you're not selling? Chuck it our way, would you? No utility too obscure."

It is what it is, and while its character is not that of commercially developed software, progress does continue to be made.

Re:Close: Switch to OS X

[cwalker]

This has been fun. I have frequented the forums for a while now and have never really posted anything other than brief comments here and there but this one I thought I would go at it full board. Thanks for replies and you are all right. My response has been short and to the point with many technicalities left out because it was a spur of the moment post. That's what makes this fun and able to enjoy everyone elses take on matters.
As far as OS X being FreeBSD is absurd and I should have stated that more correctly in that it is derived from FreeBSD. It is as close to FreeBSD as Linux is to UNIX as well as OS X is UNIX.
Stating that open source is just plain more secure is an obvious over-simplification. But the fact is that open source applications, especially the Linux kernel has a better chance of being more secure with more eyes on the code world-wide.
For somone to call Windows and Mac users my opponents is funny as well. I dont have opponents in the computer world. I support all of them. I have built fairly complex web server environments on both Linux and Windows. I have had to support Mac users in a graphics environment and have enjoyed it all. I like to express opinions as well as listen to them. And when I said "idiots" it meant that an entirely graphical Operating System to me and to most SysAdmins is a limitation more than a benefit. If you are a user of the operating system it is better through and through. In other words, at times, GUI OSes are "idiot proof" not that only idiots use them. In fact, I want to buy a Mac for my own personal use but I cant afford one for one.
In the end, my statements were just as short and rash as the original statement.
I am sure you have already read this but check this out as well http://www.apple.com/macosx/features/unix/

Also, take a look at this especially under the heading "BSD": http://www.kernelthread.com/mac/osx/arch_xnu.html

Thanks.

Re:Why is the parent a troll?

[Donny Smith]

I've been struggling with the decision what to do with my Debian server for a while now and after reading TFA I've made it - I'll move to CentOS 4.1 this coming weekend.

The problem is that each of these versions has something good, but it's impossible to get most of good sides in a single version.

And I just can't afford to wait for weeks for an updated Debian package (no, I don't want to build from source, thanks) while having my server out there exposed.

It's a good distro, but most folks who like to have fun rather than do tedious jobs ran away to Ubuntu, Gentoo and whathaven't ya...

Zdnet: do some fact checking next time

[joey]

I think it's indicative of the quality of this zdnet article that it attributes a page I maintain to Martin Schulze. More details in my blog entry, here:

http://kitenet.net/~joey/blog/entry/secfud-2005-07 -06-11-28.html

Re:Zdnet: do some fact checking next time

[cortana]

Joey, I intended to comment on your blog, except that comments aren't enabled, so I will post here.

The problem is one of communication. There has been no communication with the outside world about the recent security issues. Meaning that most users of Debian probably don't even know about the current security.debian.org problems.

IMHO, an announcement (and status updates) should have been posted to debian-devel-announce, and placed under 'news' on www.debian.org. Yet there's practicaly no information available, outside of what little is posted on Planet Debian, and debian-security. According to security.debian.org, everything is tickety-boo and a-okay. There hasn't even been a mention in Debian Weekly News. Was a response even sent to the Zdnet article to explain what was going on? I guess it was too much to expect Zdnet to contact Debian for comment--but then again, who would they ask? /intro/organization (two links away from the front page) lists Martin Schulze, whose blog they linked to in the story...

It irks me somewhat that DDs fail to provide any information about the security situation through official channels, and then get annoyed when the quasi-mainstream media misunderstand the situation. It's not entirely the fault of the media--they simply don't have much information to go on!

I have read over what little has been made available to the public, and I must admit that I'm not really sure what is going on. The only concrete information I have is that that Sarge was delayed for 18 months while security autobuilders were set up, which then failed shortly after Sarge's release. Since then, Some Stuff has happened, it turns out that most of the security team are actually inactive, and a few DSAs have been announced... but no one seems to be any closer to explaining what actually happened, or when security support will be fixed. :(

The rumors are true

[Anonymous Coward]

ZDNet confirms it, Debian is dying.

MOD Parent Insightful

[stry_cat]

Seriously how could anyone mod it as troll? Oh yeah that's right the truth hurts.

The only flaw with the parent post is that Ubuntu while much better than Debian, is still to heavily based on Debian. Hopefully the manpower which has flowed to Ubuntu will start releasing the missing security updates. Otherwise we all need to start looking towards RHEL or someother not exactly free Linux.

Re:I ditched debian over the weekend

[Zemplar]

I concur with the AC from what I've heard about older hardware. You will need about 6-10Gb on your hdd for a typical full install - the hardware you indicate should be okay to run as long as you have enough RAM, just don't expect to run circles around the new hardware. ;)

x86 suppport for strange hardware is not currently as good as Linux, but, like Linux, this only matters if you have that strange hardware.

Give it a try. I first tried Solaris last December/January and I've just recently converted all of my Linux installs to Solaris 10. IMHO, Solaris 10 runs circles around Linux. Also look into OpenSolaris.org.

Re: Ask For HELP

[mpapet]

I've installed all of the popular distros on a few different pc's with different components. This is what I've found that may/may not assist you.

1. Is your install CD okay?
Large file transfers (CD ISO's) are not perfect. Even though you can successfully burn the ISO, the ISO you burned might not be exactly right. That's why they have those handy checksums.

2. The dog (distro) just won't hunt.
It happens sometimes that the hardware/software package you have is not well implemented in a particular distro or even in Linux at all. I've had it happen a number of different times, on different pc's. Ex. I have a dual-monitor setup that set-up great in KDE, but fails miserably in Gnome.

3. I've got problems (maybe lots)that don't come up in Google.
It's unlikely you will discover show-stopper issues that others have not already documented somewhere on the web. See #1 first.

Seek help:
www.linuxquestions.org is a good place. Try to be specific.

Indeed.

[DaedalusHKX]

You are right, I can attest to having had very little trouble with Debian.

On top of my regular work, it actually plays Doom 3, playstation emulation, SNES emulation and Neverwinter Nights, Diablo 2 as well as Warcraft III.

(another debian box, running the Stable branch, is running mail, web and other services on my LAN) All for the cost of old hardware :)