Keeping older Debian distributions secure

The Debian Project has sent out a survey in an attempt to figure out how many users are still using the "Potato" distribution. The project's goal is clear: they want to figure out when they can stop providing security updates for that version of the distribution. Pulling the plug on Potato may seem a bit premature, given that Woody was only released back in July. But, for Debian, this move is already late; remember that support for Debian 2.1 ("Slink") was withdrawn just one month after the Potato release.

Debian is different from most distributions, of course, in that its users are expected to upgrade quickly. Given the ease of the process, there is generally little reason to wait. But the simple fact is that people do not like to upgrade working systems. If a computer is happily doing the tasks assigned to it, why thrash up the operating system and break things? Commercial distributors understand this inertia, and most of them go out of their way to support old distributions for at least a couple of years. As a volunteer-driven distributor, the Debian Project has had the freedom to cut off support sooner (because it does not have paying customers), and the need to do that, because it does not have paid developers who can be sent off to patch holes in ancient packages.

The fact that the Debian Project is asking for input this time, rather than simply cutting off support after one month, shows a new sensitivity toward the needs of users beyond the Debian developer community. This is a good thing, of course, but Debian, by its nature, will still be limited in the amount of support it can provide for older versions of its distribution. This is an area where companies that ship commercial versions of Debian could contribute back to the project. By paying somebody to fix security problems in older versions of Debian GNU/Linux, these distributors can enhance the value of their own products while supporting the project that supports them.

So far, no vendor of Debian-based distributions has stepped up to this plate. Indeed, Debian-based distributors tend not to bother with security updates at all, since the Debian Project itself does such a good job with them. If these companies are serious about using Debian as a base for a commercial product, however, they are going to have to get a bit more serious about long-term support. Otherwise, they are likely to find their customers going elsewhere.

---

(Log in to post comments)