Hacker News Reader

Comment by apecat | Hacker News Reader

Oh cool. As for CloudLinux, "not free" probably scale for some hosting environments, including non-managed cloud instances.

But something like Springdale, given resources, might be able to provide. They're still tracking RHEL 7, though.

Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software.

Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited.

OpenSUSE Leap versions seem to get three years, which really isn't enough software that needs to just work for a long while.

View on HN

Springdale Linux is on RHEL 8.3 but their homepage is awfully out of date.

Here's the full ISO for 8.1: http://puias.princeton.edu/data/puias/8.1/x86_64/iso/

And then you can add the repos to update to 8.3: http://puias.princeton.edu/data/puias/8.3/

Or you can take the small ("boot") ISO and install 8.3 directy: http://puias.princeton.edu/data/puias/8.3/x86_64/os/images/

In fact, they are even building Springdale Linux 8 for i386, which RHEL and CentOS never did.

If you need more than three years on openSUSE Leap, then you need to upgrade to SUSE Linux Enterprise Server.

> Debian and Ubuntu, which offer five years of Long Term Support are the next best thing available, and that's already kind of tight for long-term deployments of self-hosted, old-fashioned business software.

Remember that, in Ubuntu, the majority of packages are actually ONLY supported for nine (9) months -- not the full 5 years!

> Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited.

What are the track records of the claim?

I'm sure Ubuntu will patch stuff up if some vulnerability shows up outside of main that gets patched upstream or elsewhere.

> What are the track records of the claim?

I claim no deep expertise on this, but for a distribution of 56k packages, this looks quite good https://security-tracker.debian.org/tracker/status/release/s...

To anyone here who's worked secops and has to track these things, I'm really interested to hear opinions about how well Debian follows up on this

I trust Canonical more than Debian for security fixes. Canonical has a dedicated security team.

So does Debian https://security-team.debian.org

I claim no deep expertise on this, and I assume Canonical has more money to throw at this. Or are there contributions to Debian security in the form of paid personnel?

This is actually quite interesting to me, anyone with real knowledge of the subject is welcome to interject.

Reply on news.ycombinator.com