Hacker News Reader

Comment by Jach | Hacker News Reader

I really love Gentoo's mask system. I upgraded to 4.12.12 not too long ago, it is the latest stable: https://packages.gentoo.org/packages/sys-kernel/gentoo-sourc... You have to explicitly decide to use masked versions, at your own peril. (Of course, many Gentoo users love the bleeding edge, and I too have a number of things I manually unmasked... But the kernel? Stable only please.)

View on HN

Debian/Ubuntu has a similar mechanism. http://manpages.ubuntu.com/manpages/xenial/man8/apt-mark.8.h...

apt-mark is nothing like masking from gentoo. A-M is just for making modifications to the database that remembers whether a package was intentionally installed or was automatically pulled in as part of a dependency. This database is how apt generates the list of "packages that were automatically installed and no longer needed." The closest thing that I can think of to masking in Debi an is pulling in a package from experimental or a PPA that you added. There are no packages in the repo (stable, testing, unstable) you are using that require anything other than "apt-get install package" to install them.

You have described apt-mark {auto|manual}, but there is also apt-mark {hold|unhold}.

Damn, I always abused apt-preferences to achieve the same effect as apt-mark hold|unhold. Thanks! Does 'apt-get dist-upgrade' respect held packages?

A-M is the recommended way to hold a package, previously you would use `dpkg --get-selections`. All apt/dpkg commands will abide by what you set with A-M.

Yes, it does.

Do you think hold/unhold is anything like masking in gentoo? Me neither...

You will probably want to stick on a LTS kernel... unless you like unpatched kernel vulnerabilities.

Why? There is no reason to stick to LTS kernels if you are able to upgrade to the latest stable kernel. LTS is really meant for device manufacturers and OEMs, not desktop or server users.

The OP was not on an LTS kernel, so if it is getting security updates now it won't be for much longer. Either stick with the latest stable (they weren't) or stick with an LTS. Anything else is just playing with fire.

LTS kernels don't magically patch themselves, so if you can patch, why not be on the latest patched stable? If you're really concerned about kernel security you're already using grsecurity/PaX patches (which have neutered many otherwise 0-days) or OpenBSD anyway.

> LTS kernels don't magically patch themselves,

I never said that and, well, no shit they don't "patch themselves", so right off the bat your premise is wrong.

> you're already using grsecurity/PaX patches

Uh, no. The grsec developer is GPL violator.

Well, I mean, because of stuff like this, right?

It's always a question of "pick your poison": Debian stable users actually missed out on heartbleed completely because Lenny's OpenSSL was too old to have it.

Gentoo didn't mark 4.14 as stable (it has its own procedures for stability despite the kernel folks treating 14 as the new LTS following 9), so only users who immediately upgraded to it (manually specifying they wanted it) would be affected by this.

I really think gentoo has the best packaging story of Linux distros, except perhaps 'newer' stuff like nixos/guix. Rolling releases (my gentoo box has a continuity since 2009 with nothing ever resembling a dist-upgrade of other distros that you're forced to do to get the latest and greatest), generally gets the latest versions of stuff and their patches first or among the first if you want to live on the bleeding edge, it's easy to find overlay packages for things not in the main tree, and even create your own 'packages' since everything is source-based, USE flags for customization, and anyway it has a good stable-only option too.

And unlike in other rolling release distros (or at least unlike in ArchLinux; [citation needed]), emerge is smart enough to keep older versions of .so files so you're less likely to get unusable system/programs due to partial upgrades: [0]. I really cannot use Arch on personal computers simply because sometimes I need to keep various packages at older versions for various reasons (bugs, coredumps still in TODO, sensitive processes still running, whatever), so I inevitably end up choosing between bar+libfoo.so.X, baz+libfoo.so.Y, and rebuilding everything from scratch. (Edit: and I also cannot install older version of baz 'cause it's already gone from the mirrors.)

[0] https://wiki.gentoo.org/wiki/Preserved-rebuild

Yeah. Plus things like quickpkg (make a backup of your older installed package whose version may no longer be in the tree), demerge (record states of installed packages and configs over time), slots (conflicting pkg versions like gtk2 and gtk3 being installed at the same time) all make for more niceness.

It's definitely possible to go overboard and get into trouble. But there's a lot to help. And with gentoo I was able to weather the gnome3/systemd madness and keep that stuff off my system despite having to keep around old gnome2 and udev packages until mate, eudev, etc. were ready. I don't know too much about Arch except the pain stories friends have relayed as they eventually gave up and switched to something else. Back when Arch decided to make Python 3 the default python well before it was ready someone on IRC quipped "<dash> well that confirms my impression that arch was invented by a bunch of guys who thought gentoo was too stable and easy to use".

I haven't used Gentoo in about 10 years, but maybe I should give it a look again. I remember seeing it allows musl as a system C library, which is cool. I think mostly I just prefer the pace of Slackware though.

Reply on news.ycombinator.com