Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's wrong with enterprise Linux

unix.foo

Post reply on HN
Print view View original

31–40 of 235 posts

Re: What's wrong with enterprise Linux

#31

Post by michaelt »

darkhelmet wrote: post #7

There is another problem that wasn't covered in the article. The 10+ years of stability leads to behaviors and outcomes that remind me of the long-lived SSL certificate problem. Updating is done so infrequently that the "how?" is forgotten. As the 10 year support limit approaches, most of the old team members who did it last time are gone, tech debt is through the roof, few people know where everything is or how to b…

> I'd like to see the RHEL stability model go away too and force people to complete their automation and solve the problems of being able to rebuilding on demand - and actually doing it.

In this model, what happens when the next Python2->Python3 breaking change comes along?

Re: What's wrong with enterprise Linux

#32

Post by bonzini »

smarx007 wrote: post #9
gjsman-1000 wrote: post #3

Earlier quoted context omitted.

I actually did really like the point; but I would be very interested in hearing a rebuttal or counterargument from Red Hat. Linus' "security problems are just bugs" approach has been worrisome.

I would expect that tracking the Linux kernel master just 4 weeks behind is going to cause more cases where, combined with enterprise software of typical quality, you'd need vendor support than with the RH way of changing as little as possible for as long as possible. And support is exactly what Oracle sells. To be clear, I only used Oracle Linux briefly while playing with the free tier of Oracle Cloud. Edit: sorry,…

Red Hat doesn't change as little as possible, at least 30% of the changes to Linux make it to RHEL.

Most of the RHEL kernel is a few months behind upstream despite the old version. The next minor release of RHEL, to be released in November, probably will have features up to 6.3 for many subsystems and bugfixes up to 6.5 for example.

Re: What's wrong with enterprise Linux

#34

Post by weare138 »

mbreese wrote: post #2

> The Case for Oracle Linux I did not see that twist coming. Strangely, the author makes a good point. Oracle or not, sticking closer to the upstream kernel is not a bad way to manage an “enterprise” kernel. Maybe we’ve all been too willing to sit back and accept how RHEL does kernels as “the way”.

But what stops Oracle from just pulling a Red Hat when people switch over to Oracle Linux? Oracle hasn't exactly proven itself to be trustworthy over the years and that's putting it lightly.

I think we need a fully open source alternative to RHEL not bound to any company. Something akin to the Debian project that can serve as an upstream reference distro and repository.

Re: What's wrong with enterprise Linux

#35

Post by smarx007 »

What is Oracle going to do with the userland/RPM compat with RHEL? It's wonderful that they try to ship every fix from the LTS kernel tree and that UEK users already don't have an expectation of a 100% identical kernel. But you still need userland compatibility, which will be much harder to ensure given the sheer number of RPM packages out there.

Re: What's wrong with enterprise Linux

#36

Post by justinsaccount »

derekp7 wrote: post #13
darkhelmet wrote: post #7

There is another problem that wasn't covered in the article. The 10+ years of stability leads to behaviors and outcomes that remind me of the long-lived SSL certificate problem. Updating is done so infrequently that the "how?" is forgotten. As the 10 year support limit approaches, most of the old team members who did it last time are gone, tech debt is through the roof, few people know where everything is or how to b…

Don't you end up with the same problem with the automation that has been running fine for 5 years, then suddenly breaks? And the person that set it up is either gone, or has no clue how they did it 5 years ago.

Before LE almost no one automated SSL cert refresh. Depending on your SSL cert vendor you couldn't automate things even if you wanted to. It's not that the automation ran fine for five years, it's that you'd be lucky if the manual process last done 5 years ago was even documented.

SSLMate is about as old as LE, they both started around the same time.

Re: What's wrong with enterprise Linux

#37

Post by wredue »

azlev wrote: post #8

What's not clear to me is that newer software is safer or just less tested. Although it's possible that newer versions are more secure, I couldn't find evidence of it yet. (Links are welcome).

See. I used to think similarly. Newer software must be more secure, because we definitely know about all these problems and how to deal with them.

What that doesn’t consider is that the vast majority of programmers simply don’t care to keep up with security concerns. And that’s why two of the most dangerous, easy to exploit, easy to stop attacks out there (SQL injection, XSS) are still among the most prevalent.

As long as features are growing, the claims that new is more secure is difficult to believe.

Re: What's wrong with enterprise Linux

#38

Post by btown »

derekp7 wrote: post #13
darkhelmet wrote: post #7

There is another problem that wasn't covered in the article. The 10+ years of stability leads to behaviors and outcomes that remind me of the long-lived SSL certificate problem. Updating is done so infrequently that the "how?" is forgotten. As the 10 year support limit approaches, most of the old team members who did it last time are gone, tech debt is through the roof, few people know where everything is or how to b…

Don't you end up with the same problem with the automation that has been running fine for 5 years, then suddenly breaks? And the person that set it up is either gone, or has no clue how they did it 5 years ago.

Recently saw a (thankfully not mission-critical) old k8s cluster fall down with absurd incompatibilities between node versions, cluster versions, and cert-manager versions - all of which only support upgrades one version at a time. Even infrastructure-as-code doesn’t save you if you need to upgrade something but don’t have the time and expertise (and esoteric changelog knowledge!) to reliably upgrade everything else.

Re: What's wrong with enterprise Linux

#39

Post by dylan604 »

azlev wrote: post #8

What's not clear to me is that newer software is safer or just less tested. Although it's possible that newer versions are more secure, I couldn't find evidence of it yet. (Links are welcome).

that's why the whole rewrite in $languageX is so annoyingly frustrating when touted as fixing so many issues just because it uses $languageX. How many bugs not present in original version get introduce is always swept under the rug of the $languageX evangelists

Re: What's wrong with enterprise Linux

#40

Post by smarx007 »

bonzini wrote: post #32
smarx007 wrote: post #9

Earlier quoted context omitted.

I would expect that tracking the Linux kernel master just 4 weeks behind is going to cause more cases where, combined with enterprise software of typical quality, you'd need vendor support than with the RH way of changing as little as possible for as long as possible. And support is exactly what Oracle sells. To be clear, I only used Oracle Linux briefly while playing with the free tier of Oracle Cloud. Edit: sorry,…

Red Hat doesn't change as little as possible, at least 30% of the changes to Linux make it to RHEL. Most of the RHEL kernel is a few months behind upstream despite the old version. The next minor release of RHEL, to be released in November, probably will have features up to 6.3 for many subsystems and bugfixes up to 6.5 for example.

Interesting, thank you for the details. This means that in some way, RHEL is ahead of Oracle Linux in terms of kernels? I don't see an UEK version tracking Linux 6.1 at all, AFAIK.
Post reply on HN