this post was submitted on 01 Oct 2024
83 points (96.6% liked)

Linux

5035 readers
35 users here now

A community for everything relating to the linux operating system

Also check out [email protected]

Original icon base courtesy of [email protected] and The GIMP

founded 1 year ago
MODERATORS
 

https://security-tracker.debian.org/tracker/CVE-2024-47176, archive

As of 10/1/24 3:52 UTC time, Trixie/Debian testing does not have a fix for the severe cupsd security vulnerability that was recently announced, despite Debian Stable and Unstable having a fix.

Debian Testing is intended for testing, and not really for production usage.

https://tracker.debian.org/pkg/cups-filters, archive

So the way Debian Unstable/Testing works is that packages go into unstable/ for a bit, and then are migrated into testing/trixie.

Issues preventing migration: ∙ ∙ Too young, only 3 of 5 days old

Basically, security vulnerabilities are not really a priority in testing, and everything waits for a bit before it updates.

I recently saw some people recommending Trixie for a "debian but not as unstable as sid and newer packages than stable", which is a pretty bad idea. Trixie/testing is not really intended for production use.

If you want newer, but still stable packages from the same repositories, then I recommend (not an exhaustive list, of course).:

  • Opensuse Leap (Tumbleweed works too but secure boot was borked when I used it)
  • Fedora

If you are willing to mix and match sources for packages:

  • Flatpaks
  • distrobox — run other distros in docker/podman containers and use apps through those
  • Nix

Can get you newer packages on a more stable distros safely.

top 25 comments
sorted by: hot top controversial new old
[–] [email protected] 51 points 4 days ago (1 children)

crazy how testing is not for production. next thing you're tellling me unstable isn't stable smh /s

[–] [email protected] 2 points 4 days ago (2 children)

I mean you'd still expect that critical security fixes would land in testing, no?

[–] [email protected] 14 points 4 days ago

Why bother? Backporting security updates or updating packages is work and in case of debian often unpaid. Trixie is for testing new packages and configurations, does not make a ton of sense to keep everything up to date.

[–] [email protected] 0 points 4 days ago

it would be nice, but i only expect them to arrive with the regular package updates, i.e. when a new version of cups with the fix in it is released, not an extra quicker fix from the distro maintainer.

[–] [email protected] 13 points 4 days ago* (last edited 19 hours ago) (2 children)

Yeah, using Testing directly is a bad idea. Instead pick a distro based on ~~Testing - like LMDE (Linux Mint Debian Edition);~~ or if you really need bleeding edge use Sid instead, but be aware that it was named after the child who breaks toys for a reason.

EDIT - as the comments say LMDE is based on Stable. In my defence when I used it it was still based on Testing. (And it was a rolling release. Yup, LMDE "1" times.)

[–] moonpiedumplings 2 points 19 hours ago* (last edited 19 hours ago) (1 children)

Linux mint debian edition is not based on testijg, but rather on stable*.

This misconception may be caused by the fact that the latest debian stable, has newer packages than many of the older-but-not-ancient ubuntu releases, which were originally based off of debian sid.

*I cannot find a first party source for this, only third party

Linux Mint Debian Edition 6 hits beta with reassuringly little drama. Think Debian 12 plus Mint's polish and a friendlier UX for non-techies

https://www.theregister.com/2023/09/13/linux_mint_debian_edition_hands_on/

[–] [email protected] 1 points 19 hours ago* (last edited 19 hours ago)

I fixed it, based on info that you and @[email protected] provided. Thanks you both for pointing this out!

(The misconception is actually outdated info. LMDE 1 lasted a really long time, and it was Testing-based.)

I cannot find a first party source for this, only third party

I found info in the Linux Mint forums about this. Not quite first party source as it's just user discussion, but still closer.

[–] Scoopta 1 points 4 days ago (1 children)

Maybe it's just been good luck, or maybe I pay enough attention to what apt is going to do and know how to deal with it but I've been daily driving sid for years and am convinced it's more stable than arch based on friends I have that run arch...maybe it's just I'm more experienced but it really doesn't break that much. Obviously ymmv.

[–] [email protected] 4 points 4 days ago

I think that it's partially due to Debian's focus on stability. If they call it "stable" it's rock solid; if they call it "unstable" it's still fairly usable, it's just the 0.1% odds that it'll evoke Cthulhu in the process.

In my Sid times I managed to break it, but to be fair it was more like a Frankendebian at that point.

[–] Scoopta 16 points 4 days ago (2 children)

How are fedora or SUSE valid alternatives "from the same repos"? They're not even based on Debian or Debian repos?

[–] [email protected] 7 points 4 days ago

Maybe they use OpenSUSE's https://openbuildservice.org/. It can handle multiple distributions. It's like the AUR without touting it to be the second coming of Christ.

[–] moonpiedumplings 4 points 4 days ago

Sorry. I meant if you wanted to use only packages from one set of repositories/one distro, for if you were looking for lower level packages like the kernel or desktop environment to be updated.

[–] jim 6 points 4 days ago

PSA for Debian Testing users: read the wiki

https://wiki.debian.org/DebianTesting

Control-F security returns 18 results. This is well known and there's even instructions on how to get faster updates in testing if you want.

[–] 0x0 5 points 4 days ago

Stick to stable for production. Patches for vulnerabilities will go to stable asap. That's where you want them, not testing or unstable.