Slashdot Mirror
Debian Refuses To Push Timezone Update For NZ DST
Jasper Bryant-Greene writes "Although a tzdata release that includes New Zealand's recent DST changes (2007f) has been out for some time, Debian are refusing to push the update from testing into the current stable distribution, codenamed Etch, on the basis that 'it's not a security bug.' This means that unless New Zealand sysadmins install the package manually, pull the package from testing, or alter the timezone to 'GMT-13' manually, all systems running Debian Etch in New Zealand currently have the incorrect time, as DST went into effect this morning. As one of the last comments in the bug report says, 'even Microsoft are not this silly.' The final comment (at this writing), from madcoder, says 'The package sits in volatile for months. Please take your troll elsewhere.'"
Assuming there are, or even the possibility that one could be crafted, it seems quite justifiable to call this a security fix. And aside from that, it's just dumb not to include it.
They've taken a perfectly good distribution and absolutely destroyed its reputation thanks to their management's ineptitude.
Some systems may rely on the "wrong" timezone for their continued operation, so if it is indeed not a security update, and the policy for automatic updates is "security only", then not pushing the update is correct. If you need the timezone update, get it. It's not like they hide it from you.
i would imagine anyone in New Zealand smart enough to install Debian is also smart enough to fix this manually...
Politics is Treachery, Religion is Brainwashing
In my opinion, Debian did the right thing here.
This update is not security-related, so has no business being in the security update section. That's perfectly OK - Debian's security updates are completely safe to apply 99% of the time, because they do not change functionality. They only fix security bugs. Unlike Microsoft, Debian are not in the practice of shipping automatic updates that change functionality.
The update has been posted to the volatile repository, which is intended for things that change frequently, like timezone data. It can be installed from there right now - any of these people complaining could have simply installed the patch at any time over the past several months. The update has also been pushed to the updates repository, for inclusion in the next point release of Etch.
I don't see the problem here.
..you can bet it would have been pushed through.
Debian have promised their users that only security updates will be rolled out and that they will not release any updates that change the normal behavior of programs. They do this because Debian gets run on lots of mission-critical servers where they don't want a program changing its behavior via an "update".
Rolling clocks forward by two hours is a pretty huge change in behavior for some servers, and there isn't much of a security risk in not rolling out the update automatically, so they're not going to.
They're doing the right thing.
Note that even 2007g is out since August this year, including timezone updates for Egypt and Australia.
abolish DST! It was silly in the early 1900s when the majority of workers worked in factories, mills, or on farms. It's sillier in 2007. Get rid of that stupidity once and for all.
...is daylight savings time.
More than 60,000 Windows programs won't run on Linux.
this article is about? It's about a sysadmin who's blaming Debian for not doing her job?
As it's clearly pointed out in the bug report, this package:
1) Has not a security bug, so does not belong to security-updates.
2) Was in volatile for a long time.
3) Is scheduled for the next release of etch.
debian-volatile is a repository for this type of packages (as virus lists, tzdata, et alter) that has information/data changes/updates often. If your time zone has changed or it's about to change, it's your responsability as a sysadmin to upgrade the packages, not Debian's. There were not a bug in tzdata.
Debian is one of the best distros out there, please contribute to make it even better by filling bug reports, but please take a minute to think about what you are doing, and read carefully the developers/mantainers posts or replys, because most of the time they're right.
the real question is who do we blame this story on: kdawson or firehose?
This is what usually happens when something Debian-policy-related happens and is touted as silly:
1. I think: How silly of them. Just like Debian to do something stubborn and annoying like that.
2. Then I read the argumentation, the policy that led them to the decision.
3. I find myself agreeing with the policy and thus accepting the decision as the Right Thing.
4. I find someone, usually in the Debian project itself, has come up with a solution for those who don't like the decision.
The more time passes, the more I like Debian. They have policies that are good and they stick to them. When the policy causes them to do something that people don't like, they provide a workaround. With Debian, you can have your cake and eat it. Exclusively free software? Check. Proprietary software when you do want it? Check. Stable system that stays the same for years? Check. Recent versions of packages when you want them? Check. Support in the package manager for mixing and matching? Check. Oh, and they had dependencies figured out and working well long before any other distro I'm aware of. Debian isn't perfect, but it comes frighteningly close sometimes.
Please correct me if I got my facts wrong.
Ah... found it (and in a link from the FA, as well... go figure). The US DST changes, according to this bug report went into tzdata2006p - which, sure enough, got the changelog got pushed to stable Nov 28.
So that does beg the question - if it's okay to do it for the US, why not NZ?
"Software is too expensive to build cheaply"
What rubbish. New Zealand's technology industry is more significant to its citizens than the US technology industry is to Americans. As a small country, New Zealand's economy relies more on technological innovation than big countries do, with their natural resources and primary production. I'm not just talking about the famous examples (the electric fence, Rakon) either, but a constant push for more efficient and more valuable secondary production.
Or by significant did you mean significant to you and you alone? Who made you Captain of Industry?
Your guess about the few dozen people is also wrong. I, personally, just me, know a few dozen Kiwi Debian users, and I wouldn't say that's even close to the number that live in my suburb. Free software adoption is alive and well down under - it goes well with the 'number 8 wire' tinkering mentality that is a well-established part of New Zealand culture (Burt Munro and all that).
None of that is to say Debian should break policy - I agree that volatile is where these updates belong. But the arguments you give in favour of the status quo are bullshit.
=w=
This is debian, and there is a simple command-line based solution. Debian isn't aimed at grannies or the average corporate joe. Its primary user base is geeks and sysadmins who need rock-solid systems. And it does a damn good job of that. It also servers as a great reference implementation for others (ubuntu, et al) to customise and optimise for more specific uses.
"I think it would be a good idea" Gandhi, on Western Civilisation
But nothing else will change a bit. 0% chance that an upgrade may break your configuration file. 0% risks that all the scripts that you manually wrote will suddenly stop functionning because of subtle differences between version 1.8.6.9 and 1.8.6.10 in some obscure software.
And a 100% chance that a change in your timezone will cause your servers to suddenly have the wrong time (assuming default configuration).
No thanks, I'll stick to a platform with a more sane balance between platform stability and not breaking things.
Maybe he said 'fucking' because he fucking wanted to.
I think the participle fucking quite succinctly and accurately described the combination of amazement and frustration the author of the post intended to convey. It really is a useful word that can express complex emotion concisely: truly in the spirit of Strunk & White's rule 13.
People who reduce themselves to bitching about curse words contribute nothing to the conversation at hand.
My twitter
I solved this problem by changing wholesale to GMT/UTC on all of our servers, Linux and Windows. Now we never have to worry about another stupid DST or TZ change again, including MS charging $4K for a patch that should be free. It also makes life easier for people outside our TZ who use our servers.
;)
I just learned that I go to work at 3pm in the morning and head home at 11pm. It's not hard. I wish the world would switch to GMT, it would make everything so much easier. Businesses can have summer hours if they wish to take advantage of the longer days.
Of course, the desktops are all still on local time. There would be a pitchforks-and-torches uprising if you tried to change that.
DRM 'manages access' in the same way that a prison 'manages freedom'
Several security protocols mandate close time synchronization to minimize the risk of replay attacks, so failure to deploy this time zone change causes a denial of service. In particular Kerberos is impacted, and increasing the permissible time skew by a few orders of magnitude on every box in the domain, which not all implementations support, creates a substantial risk unless you're set up for ticket pre-authentication, which puts a greater load on the server, is not well supported by all clients, and is thus often not enabled. Admittedly, if you're using a network of Debian stable machines, you should be okay, but god forbid someone should use a Debian stable box in an Active Directory deployment.
Similar problems may exist for SSL (https, ldaps, imaps anyone?) but I'm not sure if a one hour difference would exceed the tolerance in many applications.
Disclaimer: I work for a commercial distributor.
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
There's a lot I don't understand about the things I use in my day to day life but I still use them. Micro-managing one's operating system is a foolish waste of time and loss of productivity. My operating system exists to grant me access to the tools I've installed to perform tasks relevant to my daily life and career. This is something that should be done right the first time without any political nonsense getting in the way. A timezone patch not stable? Now I've heard it all. Next thing you know my /etc/issue file will be unstable.
BD Phone Home!
Shameless plug. Like you weren't expecting it.