this post was submitted on 01 Oct 2024

88 points (96.8% liked)

Linux

15259 readers

347 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

PSA: You should know that Debian Testing does not receive security updates in a timely manner, and is not intended for production use (programming.dev)

submitted 2 years ago* (last edited 10 months ago) by moonpiedumplings@programming.dev to c/linux@programming.dev

26 comments fedilink hide all child comments

https://security-tracker.debian.org/tracker/CVE-2024-47176, archive

As of 10/1/24 3:52 UTC time, Trixie/Debian testing does not have a fix for the severe cupsd security vulnerability that was recently announced, despite Debian Stable and Unstable having a fix.

Debian Testing is intended for testing, and not really for production usage.

https://tracker.debian.org/pkg/cups-filters, archive

So the way Debian Unstable/Testing works is that packages go into unstable/ for a bit, and then are migrated into testing/trixie.

Issues preventing migration: ∙ ∙ Too young, only 3 of 5 days old

Basically, security vulnerabilities are not really a priority in testing, and everything waits for a bit before it updates.

I recently saw some people recommending Debian Testiny for a "debian but not as unstable as sid and newer packages than stable", which is a pretty bad idea. Testing is not really intended for production use.

If you want newer, but still stable packages from the same repositories, then I recommend (not an exhaustive list, of course).:

Opensuse Leap (Tumbleweed works too but secure boot was borked when I used it)
Fedora

If you are willing to mix and match sources for packages:

Flatpaks
distrobox — run other distros in docker/podman containers and use apps through those
Nix

Can get you newer packages on a more stable distros safely.

all 29 comments

sorted by: hot top controversial new old

[–] lurch@sh.itjust.works 51 points 2 years ago (1 children)

crazy how testing is not for production. next thing you're tellling me unstable isn't stable smh /s

[–] al4s@feddit.org 2 points 2 years ago (2 children)

I mean you'd still expect that critical security fixes would land in testing, no?

[–] uiiiq@lemm.ee 14 points 2 years ago

Why bother? Backporting security updates or updating packages is work and in case of debian often unpaid. Trixie is for testing new packages and configurations, does not make a ton of sense to keep everything up to date.

[–] lurch@sh.itjust.works 0 points 2 years ago

it would be nice, but i only expect them to arrive with the regular package updates, i.e. when a new version of cups with the fix in it is released, not an extra quicker fix from the distro maintainer.

[–] Scoopta@programming.dev 15 points 2 years ago (2 children)

How are fedora or SUSE valid alternatives "from the same repos"? They're not even based on Debian or Debian repos?

[–] bjoern_tantau@swg-empire.de 7 points 2 years ago

Maybe they use OpenSUSE's https://openbuildservice.org/. It can handle multiple distributions. It's like the AUR without touting it to be the second coming of Christ.

[–] moonpiedumplings@programming.dev 4 points 2 years ago

Sorry. I meant if you wanted to use only packages from one set of repositories/one distro, for if you were looking for lower level packages like the kernel or desktop environment to be updated.

[–] jim@programming.dev 8 points 2 years ago

PSA for Debian Testing users: read the wiki

https://wiki.debian.org/DebianTesting

Control-F security returns 18 results. This is well known and there's even instructions on how to get faster updates in testing if you want.

[–] 0x0@programming.dev 5 points 2 years ago

Stick to stable for production. Patches for vulnerabilities will go to stable asap. That's where you want them, not testing or unstable.

[–] curbstickle@anarchist.nexus 2 points 10 months ago (1 children)

Trixie is the current stable.

Forky is now testing.

Sid is always unstable.

[–] moonpiedumplings@programming.dev 2 points 10 months ago (1 children)

Did you post this right as I edited the title? Lol.

[–] curbstickle@anarchist.nexus 1 points 10 months ago

That or the edit didnt federate in time for me to see it change :)

[–] mech@feddit.org 2 points 10 months ago* (last edited 10 months ago)

If for some reason you insist on using plain Debian but want newer packages on your private browsing-and-gaming desktop, regularly back up your data and run Debian Unstable.
Actually read what apt does on a dist-update, and if it wants to remove packages you need without installing replacements, abort and try again tomorrow.

On any important production system, regularly back up your data and run Stable. You lived without that shiny new feature yesterday, you'll still survive without it today.

[+] toasteecup@lemmy.world -13 points 2 years ago (2 children)

I would sooner use Windows before using Fedora. Fortunately, Linux Mint or Ubuntu exist instead.

[–] sweng@programming.dev 9 points 2 years ago (1 children)

I would sooner use Windows before using Fedora

Why?

[–] toasteecup@lemmy.world -3 points 2 years ago

https://lemmy.world/comment/12653110 too lazy to copy pasta the whole thing

[–] Contort3860@links.hackliberty.org 8 points 2 years ago (1 children)

I'm not a fan of Fedora either, but it's still linux. Always better than Windows, unless you have some very serious reason for disliking it that much.

[–] toasteecup@lemmy.world 2 points 2 years ago (3 children)

Not sure if anyone else will think it's good enough but I do.

Redhat as a company acts like a parasite on open source, producing a product that is garbage which they then charge money for their support plans. Have an issue with their offering? Fuck you. In addition to that, I absolutely beyond a doubt HATE how they do their filesystem and just willy nilly do whatever the fuck they think is best instead of following community established patterns and designs. Top it off with, who was the first to adopt systems? Redhat.

Stepping away slightly from that, have you dug into ansible's internal before? Actual fucking idiot decisions. Have an issue with tower or AAP (stupid fucking name) good luck getting it fixed. According to their documentation you can have vaulted vars in a cars file with plaintext cars. According to reality, that's causes intermittent failures and has for the past 8 years. There have been SEVERAL GitHub issues submitted but it's still not fixed.

Fuck redhat and fuck their bullshit like fedora. If I wanted to use a garbage distro, I'd at least want to use one that isn't pretending to be decent.

[–] SQkwax5cJJ2N9b@programming.dev 6 points 2 years ago (1 children)

More specifically, what issue do you have with their "filesystem"? Not using ansible, but i think fedora is miles ahead of arch for example.

[–] toasteecup@lemmy.world 2 points 2 years ago

Layout of where they put their files had (the last one I actually had to dig into a fedora system) multiple violations of the FHS. I'm very big on standards since things work well when you're not violating standards.

Obviously, people don't have to follow the FHS and redhat definitely doesn't but doing so gives more of a nice consistent experience to any technician, sys admin or sys engineer.

[–] 0x0@programming.dev 6 points 2 years ago (1 children)

Ever heard of Rocky?

[–] toasteecup@lemmy.world 4 points 2 years ago

It's new to me, reading up on it now. Seems cool given the goals and it's the OG CentOS guy. I wasn't the biggest CentOS fan, but I liked it more than fedora for sure. It does still have similar issue like FHS violations but given it's not a redhat product I'd be more willing to use it.

[–] Contort3860@links.hackliberty.org 5 points 2 years ago (1 children)

Mostly my reasons for avoiding Fedora as well. But if someone else ends up on Linux due to Fedora then it's still better than Windows.

I might not like it but it might, sadly, be perfect for someone else.

[–] toasteecup@lemmy.world 3 points 2 years ago

That's a fair way to think about it and I think I'd agree with you on it's better that someone is on Linux even fedora than Windows but for myself I'd take windows over fedora. Appreciate you engaging respectfully.