Trouble at Linux Mint — and beyond [LWN.net]

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 16:23 UTC (Thu) by khim (subscriber, #9252)
In reply to: Trouble at Linux Mint — and beyond by pabs
Parent article: Trouble at Linux Mint — and beyond

Of course, no. But then distribution model is broken beyond repair anyway. There are constant bickering about bundled libraries, but the whole discussion is so bizzare it's not even funny.

Sure, if some popular library is updated and project which uses it does not issue a new version then you vulnerable. But are you protected if said project is changed to use library which is system-provided and thus updated? No, of course not: if project does not care about security enough to replace the library they depend upon then what chance is there that they would fix bugs in their own code? Or do you really believe that overworked distribution packagers could actually find time to do an actual review for the code of the software they are packaging?

Distributions were born to solve one simple problem: slow internet gave no way to easily download large packages and small HDDs needed shared libraries to save space. That's it. We should stop pretending that they are solving any other problems - and the problems of slow Internet access and small HDDs are largely behind us, too.

Distributions in their current form are part of problem, not a solution.

to post comments

Trouble at Linux Mint — and beyond

Posted Feb 27, 2016 5:22 UTC (Sat) by pabs (subscriber, #43278) [Link] (1 responses)

Are you manually downloading, compiling and installing upstream projects like Linux, glibc, PHP and ownCloud instead of using a distribution?

Trouble at Linux Mint — and beyond

Posted Mar 1, 2016 11:04 UTC (Tue) by nix (subscriber, #2304) [Link]

I do! But unlike khim I recognize that I'm a bit of a lunatic and that what everyone else, particularly people looking for security, should do is use a distro to let the trouble off them and to avoid wasting time. (My network-exposed and sensitive boxes run Debian stable, though with glibc replaced to get my stack-protector patches. I'm *so* looking forward to not having to do that last bit.)

I don't do this because of security -- that's a ridiculous stance. I do this because I'm a control freak and hate changes in my working environment and don't want anything to change unless I changed it, and because I want to know the interrelationships and build trickeries of every package I run. I'd now say "because it's been useful in my job so often", which is true, only that doesn't explain why I started doing it fifteen years before I worked for a Linux distributor. The correct explanation is "because it's a habit and a really silly hobby", kind of like stamp collecting with packages. It is not a security benefit.

Trouble at Linux Mint — and beyond

Posted Feb 27, 2016 14:52 UTC (Sat) by lsl (subscriber, #86508) [Link]

> Distributions were born to solve one simple problem: slow internet gave no way to easily download large packages and small HDDs needed shared libraries to save space. That's it.

Nope. What pabs said, really. Distributions do a lot of work so you don't have to.

There's maybe a dozen of packages where my needs are special enough that I'm not getting them from my distro, directly tracking upstream instead.

Some of them are (intended to be) temporary and I'm working towards being able to just use the distro packages. Why? Because tracking those projects takes time. I can only afford that for a small set of packages I care deeply about. Doing it for all the software on even my personal machines is simply not realistic - that'd be a full-time job.

This is what distros provide to you.

Trouble at Linux Mint — and beyond

Posted Feb 28, 2016 23:59 UTC (Sun) by thoeme (subscriber, #2871) [Link]

>Distributions were born to solve one >simple problem: slow internet gave no >way to easily download large >packages and small HDDs needed >shared libraries to save space.
That's way too short sigthend: my distribution gives me a fully consistent linux experience on my workstation, and I very seldomly leave this comfort zone because of the simple fact that *they* know better than me what to fix and what to leave alone. If there are problems, I report them and wait for the fix from my distro, trying to temporarily work around the problem (like pulling problemeous hardware) instead of spending hours to try to ducktape the problem myself.... which seldom works anyway.
So in that light, the distribution *is* my upstream and I care less about the project itself.