Hacker News Reader

Comment by efiecho | Hacker News Reader

I have used Alpine Linux for a long time even before they switched to musl libc, and I really liked it. However, I have now stopped using it because of the situation with security updates.

Very often critical security issues will not be patched for weeks and desktop software like Firefox can go months without being updated.

I would really love to use Alpine Linux again for my servers and desktops if the situation improves, but now it's simply too dangerous to depend on it.

View on HN

They seem to be understaffed, and would probably benefit from having additional maintainers.. You could always volunteer.

Yes this is probably the problem, and I think the maintainers do everything they can.

I was not writing the post to criticise Alpine as I really like it, but people need to take the missing security updates into consideration before they start to depend on Alpine for important things.

Arch is another good option to consider that receives frequent updates. However, Alpine package contribution isn't that challenging; but I'd like to see more CI integrations to automate the heck out of package updates.

I often look at the wiki pages for Arch as they are really good, but I will not use systemd so Arch is not for me.

Switching Arch over to OpenRC isn't overly difficult. [0] (A package and a kernel parameter).

Or there's the fork [1] where that is the default.

[0] https://wiki.archlinux.org/index.php/OpenRC

[1] https://artixlinux.org/faq.php

In addition to the others mentioned, I shall mention Thomas Caravia's Archnosh.

* http://repo.or.cz/archnosh.git

> I was not writing the post to criticise Alpine as I really like it, but people need to take the missing security updates into consideration before they start to depend on Alpine for important things.

I tried Alpine Linux and was very impressed, but have always resisted using it for container images because they do not publish CVEs or seem to have much process around security.

You might check out Void Linux (just in case you haven't already): they have a musl variant and it's more desktop-oriented than Alpine.

I actually switched to Void Linux after having used Debian on the desktops for some time last year and I will say it's a near perfect Linux distro.

Reply on news.ycombinator.com