Ubuntu LTS: many vulnerabilities despite long-term support | Hacker News Reader

Ubuntu LTS: many vulnerabilities despite long-term support

wilderssecurity.com

128 pointstherealmarv47 comments

I don't quite understand why people are upset with this. This is common in every, single Linux distro. Some vulnerabilities are simply not worth patching. Debian also has quite a few unpatched issues:

https://security-tracker.debian.org/tracker/status/unreporte...

And CentOS doesn't even publish that data because it would probably terrify you...

The fact is that not all vulnerabilities are equal. Some silly crashing bug in Wireshark cannot be equated to an easily-exploitable RCE in some widely used library. I am pretty sure most of the latter are fixed everywhere, whereas the former should be ignored. If your use case really really requires fixing such low importance issues, then patch it yourself, or pay support fees to someone who will do it for you.

And the fact that Debian patches some issues but Ubuntu does not is simply a question of how much work has been put into it. If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. Ubuntu, I assume, must go through a much more grueling process to get fixes out. Use whichever fits your use case...

Given the claim "Ubuntu has a number of vulnerabilities that are patched in Debian," I am unsure of how "Debian has unpatched vulnerabilities too" is supposed to make me feel better, given that Debian is an upstream of Ubuntu and so presumably those are ALSO unpatched in Ubuntu.

Debian is an upstream of Ubuntu only in the development release. Ubuntu stable releases are effectively branches (like the stable releases of every other distro).

Stable release maintenance of Debian and Ubuntu are thus independent in principle.

In practice patches for one are likely to be similar to what is needed on the other, issues affecting one are likely to affect the other, there are Debian developers who are also Ubuntu developers, Canonical employees who are also Debian developers, everyone is working towards a common goal of stable maintenance, and so forth, so there is quite a bit of communication and cross-pollination between the two. For example: I'm a Canonical employee and Debian maintainer; today I've spent quite a bit of time working on a security fix for a package I maintain in Debian that I'm effectively being paid to do by Canonical.

> If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora.

That seems like an unfair statement. Debian is a stable distro and I'd say has a pretty good track record of doing what it does. It seems disingenuous to suggest they're patching willy nilly.

I did not mean to belittle the efforts of package maintainers, most of which are people who don't get paid for it and do it out of their own volition (which I applaud!). They definitely put hours upon hours into improving the software that is shipped in Debian (or any other community distro for that matter). But you cannot argue that the efforts of a single maintainer compare to the effort of a dedicated engineering team, QA team, and a release engineering team of an enterprise company (Ubuntu, Suse, Red Hat), whose only job is to assure that every single bug is patched correctly.

Well of course, but debian isn't developed by a single maintainer, there's about 260 active maintainers and I believe well over 1000 contributors per year.

Either way, I don't think we should compare either on anything other than what they produce. You're free to think Ubuntu providers a better distro but please base it on something that isn't meta such as number of paid employees, because that does a disservice to those who give up their free time.

Distros like Manjaro have been on the receiving end of criticism regarding security updates, but how worse is it really compared to the more mainstream distros? I, as a layman, see no difference.

Didn't Manjaro suggest rolling your system date back because their certificate were out of date?

Sometimes it's not what went wrong, it's your approach to fixing it.

Well, no excuse for something like that. That's bad. I'm wondering generally though, after it reached some maturity (let's say 2016+ Manjaro), what's the difference in security of that distro compared to something like Debian? Is a distro like Arch more secure than any other? And do you need to be a Linux guru to be "safe" as a desktop user? Or does it really not matter that much at all to the casual user? Again, I'm a layman, genuinely interested in this topic. As you might have inferred, I've recently switched from Debian to Manjaro, and Debian was my first "home" Linux.

I think it's about what tools you use day to day. If, for example, you have SSH installed on your machine but don't have sshd enabled, then you could care less how outdated it is. Nobody is exploiting you through it if it's not running. If all you use your workstation for is browsing and text editing, then it's safe to assume you want those two applications to be as secure as possible. You can then look at, for example, what browser version the distro of your choice ships and judge it from that. Firefox, as an example, releases quite often and a distro that doesn't keep up with those updates gets a minus point from me. This is my personal view at things and may not sit with everyone.

Maybe Wireshark isn't the best example, since it's a tool one tends to use to identify potentially malicious traffic in the first place.

Exactly! So why would you ever consider this to be a safe application, with or without the vulnerabilities? Wireshark should be used in a closed environment (VM) as should all tools that handle potentially malicious data.

"The thing is that those vulnerabilities are all fixed in Debian as all provided packages are maintained and security fixes are backported."

Why can't Canonical move these fixes to Ubuntu LTS then? Seems the majority of the work (finding the cause, patching the code) was already done and corrections are sitting on some development branches from other distros.

That's the problem with frozen releases. Upstream just moves ahead with new versions, but the distro insists on keeping the same version and only backporting a few patches.

This might make sense for core packages that need to present a stable API throughout the lifecycle of an LTS release, but it creates a whole bunch of needless work for maintainers of other packages (who are often the same people who work upstream). Frozen distros are essentially telling them to create a frankenversion of their own program, one for each distro, based on some arbitrary version from several months or even years ago.

Until a few years ago, most distros shipped a frozen version of Firefox and only backported important fixes. Ubuntu finally gave up and started shipping new versions of Firefox as soon as Mozilla releases them. I think they need to do the same with most of the packages in "universe", too, including the vast majority of GUI apps. No backporting, just pull the new version, build it, and run some tests. It would save a lot of duplicate work that every upstream is already doing, at negligible cost to the stability of the LTS release as a whole.

Ubuntu accepts contributed security updates for all packages, including for those in universe. Canonical only pro-actively monitors and pushes security updates for packages in main. Packages in universe gets security updates if and when they are contributed by the community.

The "majority of the work" is done by upstream really, not other distros. The remaining work is backporting and QA which is distribution-specific, since the target versions (both of the package being updated and interactions with other packages that might be affected) are not necessarily the same.

Too busy working on a mobile platform that no one will ever use?

As there's already automatic(?) tracking for unfixed CVEs in "universe" at https://people.canonical.com/~ubuntu-security/cve/universe.h..., it would be a short step to a local tool that disables and/or warns users about running the programs when there are remote vulnerabilities.

All in all it's pretty irresponsible to allow the current situation in the first place. Don't ship vulnerability-prone internet-facing C apps that you can't patch.

I wonder what the patch situation in practice is with CentOS installs that enable EPEL?

> All in all it's pretty irresponsible to allow the current situation in the first place. Don't ship vulnerability-prone internet-facing C apps that you can't patch.

I think it's even worse because they won't patch or remove it. They could, but they do not consider it a problem. Ubuntu just imports everything from Debian. Things not relevant to the core team at Canonical are just thrown at the community basically saying "if you want a safe OS, you have to support this by yourself now". All the while Canonical is building their in-house, partly closed-source solutions to already solved problems.

That description of how Ubuntu deals with repositories is factually wrong. There are two repositories (in essense), Main and Universe [0].

For packages in Main a core developer (could be Canonical or someone else) has to be assigned to look after it and the Ubuntu security team has to allow it into the repository on the basis of it having a good security record and being maintainable [1]: it is _true_ that the Ubuntu security team is basically all Canonical employees. Many of these packages follow the upstream and don't come from Debian: or in some cases it's the same Canonical employee who maintains both the Debian and the Ubuntu packages so they might upload to Debian and pull in, or upload to both [2].

For Universe, Ubuntu pulls and builds from Debian. Many packages are sponsored by a maintainer who can then choose to upload their own package rather than use the latest sync from Debian. They aren't "thrown" to the community, rather they are never "promoted" to Main.

All distributions have to choose how they deal with the large 'Universe' of software out there: in the Debian/Ubuntu world there's always been a lot of packages, compared to commercial RPM world. In Ubuntu's case the decision was to build/provide those packages, and let users decide what they wanted to do: for a 100% secured environment you would only turn on Main which is why the tools show you the supported status.

The next question is whether it's a problem. It's not a problem if you understand a bit about how your distribution works. We can also look at the fact that it's been this way since Ubuntu started - so from 2004 it's worked like this.

Clearly you don't like Ubuntu, which is fair enough: but I have to ask what you mean by "partly closed-source solutions" when there's nothing involving desktop Ubuntu that is closed-source. I assume you don't like Unity or something, but it's very much open source. Unless you are thinking of something else I'm unaware of?

[0] https://help.ubuntu.com/community/Repositories/Ubuntu

[1] https://wiki.ubuntu.com/MainInclusionProcess [2] https://www.piware.de/tag/debian/ is an example of someone who does this.

A bit scary but I understand ubuntu probably don't have the resource to watch all those packages all the time for verifying/backporting/testing etc.

As far as security goes, Ubuntu really should work together with Debian to leverage each other to better the situation. My sites run either LTS or Debian and now I'm more worried.

Not so much actual worry. Such panic articles appear regularly.

If you stick with official packages, you are fine. It is the front-facing services that are important, and these are updated for security issues.

I ran those checks and most problematic packages are related to ruby, as I ran redmine which uses Ruby.

To be fair, many packaged applications in popular distros are insecure (OwnCloud in Debian as one example). The developers of the applications will tell users specifically not to install the packaged version of the application, because it is out of date and/or insecure.

PPAs were supposed to solve this problem, and the official line is that Snap packages are supposed to solve this problem, but better.

I don't remember ever seeing a ppa systematically handle security updates. It stands for "personal package archive" and lives up to its name...

A rare few vendor ppas are frequently updated with the newest major version of the app for latest 1 or 2 LTS releases until they aren't, that's about the best I've seen.

snap is also not the silver bullet https://mjg59.dreamwidth.org/42320.html

Snap packages with isolation aren't a 'silver bullet' but they are a step forward. It continues a trajectory of trying to secure desktop endusers with steps like AppArmor and kernel hardening that were don't for other LTS releases.

At least in terms of package format, the difficulty with dpkg is that a) general software developers don't understand it, and b) it's not transactional in the sense you can't reverse what's happened easily.

Trying to get commercial developers onto Linux is very difficult: on the desktop side they often don't see the point of such a small platform, and on the server side they feel it's super complicated and difficult. It might be stating the obvious but most developers aren't system administrators, so they really, really struggle with packaging and complain about dpkg/rpm a lot. Appstores are both tools and a process: Ubuntu did developer.ubuntu.com to provide an easy process for developers, and snap packages are another step along that way.

Lets not let the perfect get in the way of the improved!

owncloud was removed from Debian.

There is only one really problematic package that is not supported in the current 16.04 release: network-manager-openvpn

Please support the bug report on Launchpad:

https://bugs.launchpad.net/ubuntu/+source/network-manager-op...

Are there open CVE's regarding it?

Someone once asked me about wilders security. I told them I did not know much about it other than it was forum primarily for windows folks. I have never seen any discussions I wished I was part of from wilders. Is anyone familiar with wilders?

While the point about the different level of support of different repos is a good one and it does deserve more awareness, without the right context the claims of the article are easy to mis- or over-interpret.

I think a fair comparison would be to show other distros too rather than judge Ubuntu based on a single data-point.

For instance, a user stuck with ancient packages on CentOS may quickly reach out to alternative repos and pull in tons of packages with questionable security.

This title is misleading.

The article is a post on a bulletin board by someone stating two facts:

a. Canonical "claims" they provide Long Term Support b. That support is for the "Main" repository only.

Neither of these points is incorrect: though "claim" clearly implies their opinion. All the Linux distributions need to draw the line somewhere on what software they will provide security for: Ubuntu comes from the Debian tradition which packages a large swathe of software, so to differentiate levels of support/origin they are separated into repositories. Other distributions reduce the total amount of packaged software made available, to deal with the same issue.

The title is misleading because it implies that Ubuntu LTS' security record is poor: which this article is not discussing.

As someone who runs Ubuntu Desktop, should this be concerning?

Currently I am running 14.04 which I keep regularly updated. The only other software I have installed is plex media server and chrome. Seems like I would be more at-risk if I were running more 'non-main' packages, but I am not really sure what that means.

Such panic articles appear every so often. People have to dramatize in order to be heard.

As a desktop user, you interact with the hostile Internet through your browser, which is updated as soon an issue appears. You might open PDF documents, so this is evince. Or Libreoffice for .doc. Both are in main and get security updates.

LibreOffice isn't in Main; it's in Universe. You've just unintentionally demonstrated how Ubuntu is less secure than many of its users realize.

if you use software from universe you can check their support in the article linked. VLC is a good example. You need to check 1 by 1 if there is a new one

Ubuntu is nice as a (1) desktop, but I can't see it's benefits as a server operating system. It's harder to configure, and more opaque than the alternatives. The devs seem amateurish and the company is too much unfocused for its size. The system is not well integrated and surprising changes occur frequently. Documentation is scarse and fragmented. There are systems like BSDs and maybe some Gnu Linux distros where the behaviour of the system and that the devs are way more predictable and processes and practices transparent. Why use Ubuntu for server, for other than its popularity and tradition? Is there actually any pros to it that I don't know?

(1) Edit: Removed "disability" from here, autocorrect accident.

You might want to expand your idea with some actual details since it's not clear what you mean by e.g. “harder to configure and more opaque” or even just which alternatives you mean.

In general, I've seen developer preference for two reasons:

1. Debian & Ubuntu both share a massive collection of packages which have frequently been packaged in a manner which is amenable for automated system configuration (compare e.g. the tendency to use a combination of debconf and the preference for `.d` layouts so you don't have to modify files which will be overwritten by updates).

2. Ubuntu adds the entire PPA ecosystem which supports the very common case where people want LTS + a small number of packages which are updated more frequently.

A large fraction of users seem to disagree! Ubuntu is the most popular server distro in the cloud, by far.

http://fossbytes.com/ubuntu-linux-is-the-most-popular-operat... https://duh6oa3w9hopv.cloudfront.net/uploads/pdfs/RightScale... etc.

The must be doing something right, but of course as quickly as they rose, they could loose the market equally quickly. I do see interesting directions, though: Ubuntu seems to be the default choice on OpenPOWER servers (at least for now) and it will likely be a strong contender; see e.g. https://www-03.ibm.com/press/us/en/pressrelease/47791.wss

One group that has certainly contributed and needs to be given credit is Debian!

I believe that's because devs want to use what they use for their workstation (that is, what they know the best) on their servers. That's understandable, and most cloud services give you boxes that are already usable but because you don't have sth. like the FreeBSD handbook, and because the whole thing is not that thightly integrated, complex stuff requires hacks and dirty workarounds or at least a lot of experience. I have not done any system-admin work, but I can say this: in one week I've managed to make my FreeBSD system completely reproducible after using it for the first time. I haven't been able to do that with any Gnu/Linux, and I've used it for more than ten years till last february I guess.

I take your point about FreeBSD's benefits, but we need to be realistic.

People want working devices/peripherals (admittedly, I'm not very familiar with the state of the drivers on FreeBSD today, but I know it has been an issue) and many prefer to be productive too rather than hack away at their OS. These OSes have moved out of the garage and are running a large part of this damn Internet :)

FreeBSD is certainly perfect for some niche uses but, I believe, it isn't realistic for many if not most GNU/Linux server uses today.

And that's where I'd come back to your initial point on Ubuntu's lacking server benefits: you may not see them, but many do, and for better or worse they vote with their choice. Even if many don't like it, let's be honest, many do benefit from it indirectly.

Ubuntu has done a really great job of getting its distributions into as many hands as possible. Consider these stats:

- http://unix.stackexchange.com/questions/tagged/debian - 5K questions

- http://stackexchange.com/sites?view=list#traffic - 224K questions

I meant technical benefits over other distros and Unix-likes.

well, if you have snappy as a base, with secure features such as roll back on fail update (such as the kernel) will be there (not yet on LTS I think).

If you need maas, juju (whitch of course can run on others distro), a system with 5 years of security updates without extra fees,

You can get similar (and even more) features from openSUSE Leap.

I think the complete opposite. I don't like the desktop version so much but love the server. The support in the community is big (and bigger than most other distros) and I know Debian and know how to handle Ubuntu which has a more predictable support window time. Why should I use something else if I know my friend&enemy? Also I get a lot more software preconfigured for it, also ppa is a system not every other distro has.

If we expect Ubuntu/Canonical to support universe packages then you should expect Apple to support all released OSX and iOS packages too. That would be insane, just like this article is.

Reply on news.ycombinator.com