Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yes, Ubuntu is withholding security patches for some software

flu0r1ne.net

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Yes, Ubuntu is withholding security patches for some software

#11

Post by panarky »

svc0 wrote: post #10
isaacremuant wrote: post #8

Earlier quoted context omitted.

That's absolutely terrible and not clear at all. I've been tempted to go back to Arch and I think this can be a good motivator.

Just to be clear, on Arch ffmpeg is outdated (6.0 vs 6.1.) This means it has three security vulnerabilities.

Debian's ffmpeg is at 6.1, no subscription nonsense required.

Re: Yes, Ubuntu is withholding security patches for some software

#12

Post by viraptor »

svc0 wrote: post #10
isaacremuant wrote: post #8

Earlier quoted context omitted.

That's absolutely terrible and not clear at all. I've been tempted to go back to Arch and I think this can be a good motivator.

Just to be clear, on Arch ffmpeg is outdated (6.0 vs 6.1.) This means it has three security vulnerabilities.

It's not the case for this example of ffmpeg (it's actually not patched), but make sure to check the actual changelog. Sometimes the version is kept, but the patches are backported, so a plain version comparison is not enough.

Re: Yes, Ubuntu is withholding security patches for some software

#14

Post by extraduder_ire »

geokon wrote: post #13
wmf wrote: post #3

Debian is looking better and better.

Except it doesn't really have PPAs ... which limits outside contribution and is a huge downside

IIRC, you can still add those repos. The PPA system just makes it a little easier to add them.

Re: Yes, Ubuntu is withholding security patches for some software

#15

Post by personomas »

extraduder_ire wrote: post #14
geokon wrote: post #13

Earlier quoted context omitted.

Except it doesn't really have PPAs ... which limits outside contribution and is a huge downside

IIRC, you can still add those repos. The PPA system just makes it a little easier to add them.

Can you explain how better? A link to an example maybe

Re: Yes, Ubuntu is withholding security patches for some software

#16

Post by geokon »

extraduder_ire wrote: post #14
geokon wrote: post #13

Earlier quoted context omitted.

Except it doesn't really have PPAs ... which limits outside contribution and is a huge downside

IIRC, you can still add those repos. The PPA system just makes it a little easier to add them.

it's one of those things that will probably work most of the time

PPAs are built against Ubuntu packages as dependencies - which usually but not always match Debian ones. Easy way to get subtly broken programs

Re: Yes, Ubuntu is withholding security patches for some software

#17

Post by diffeomorphism »

isaacremuant wrote: post #8
svc0 wrote: post #7

Earlier quoted context omitted.

Universe packages are not supported by Ubuntu unless you activate Ubuntu Pro. Thus, if you install ffmpeg on Ubuntu without Pro, it will contain several active vulnerabilities. The full five years only applies packages in the main repo.

That's absolutely terrible and not clear at all. I've been tempted to go back to Arch and I think this can be a good motivator.

That is also absolutely unchanged compared to "since forever". Canonical supports "main", while "universe" and "multiverse" offer best-effort community support (aka from debian). They now additionally offer a dedicated team for those repos.

Honest question, since the arch wiki seems surprisingly spotty on this: Which arch repos are covered by their security team? Just core? Or also extra? More than that? AUR surely not, right?

Re: Yes, Ubuntu is withholding security patches for some software

#18

Post by guappa »

diffeomorphism wrote: post #17
isaacremuant wrote: post #8

Earlier quoted context omitted.

That's absolutely terrible and not clear at all. I've been tempted to go back to Arch and I think this can be a good motivator.

That is also absolutely unchanged compared to "since forever". Canonical supports "main", while "universe" and "multiverse" offer best-effort community support (aka from debian). They now additionally offer a dedicated team for those repos. Honest question, since the arch wiki seems surprisingly spotty on this: Which arch repos are covered by their security team? Just core? Or also extra? More than that? AUR surely n…

Not even "from debian". Sometimes they can't be bothered to copy debian packages that fix security issues if the package is in universe, and just leave it vulnerable for the entire duration of the LTS.

Happened to me.

Re: Yes, Ubuntu is withholding security patches for some software

#19

Post by xinayder »

svc0 wrote: post #7
panarky wrote: post #4

I'm so confused. When I install an LTS version with a Universe package like ffmpeg, does everything continue getting security patches for the full five-year LTS life? Or do I now need Ubuntu Pro to get the full five years?

Universe packages are not supported by Ubuntu unless you activate Ubuntu Pro. Thus, if you install ffmpeg on Ubuntu without Pro, it will contain several active vulnerabilities. The full five years only applies packages in the main repo.

I wanted to find another reason to not use Ubuntu for servers (besides Snap being forced on everyone) and this was it.

At least, in Debian, most of the packages I use on my server are from their main repos. Occasionally there are a few from other sources but by the time a new Debian patch is released, those other packages are also updated.

Re: Yes, Ubuntu is withholding security patches for some software

#20

Post by gettodachoppa »

geokon wrote: post #13
wmf wrote: post #3

Debian is looking better and better.

Except it doesn't really have PPAs ... which limits outside contribution and is a huge downside

What is the advantage of PPAs over an apt repo that users place in /etc/apt/sources.list.d/someexternalapp? Is it having a central site that users can search for packages? Basically a social portal?
Post reply on HN