Hacker News Reader

Comment by airstrike | Hacker News Reader

I loved Ubuntu around 2007-2009 or so. Nowdays it feels like there are plenty of alternative distros that "just work" without so many of the idiosyncratic stuff canonical keeps dumping into what used to be "debian for the masses"

> As Linux evangelist Mark Pilgrim once quipped, Ubuntu "is an ancient African word meaning 'can't install Debian'".

https://www.theregister.com/2009/02/16/debian_lenny_review/

View on HN

Debian has a strange approach to security these days.

There are over 100 unpatched vurnurabilities in their version of Chromium for example:

https://security-tracker.debian.org/tracker/status/release/s...

Because of this, I don't see debian as an option for the Desktop anymore.

I hope they still fix the server software in their repos.

Looks like all the CVEs are fixed in Debian Sid at least.

Edit: Not all, apparently. The whole bottom of that Chromium CVE list is still unfixed in Bookworm/Sid.

Which makes a good case for rolling release distros. Not that Sid is released but things tend to get fixed upstream quickly and there’s less lag than both testing and stable.

The flip side is stuff breaks more regularly of course.

Check how many vulnerable packages they have against their stable release across all packages and how long until they’re fixed. It’s an eye opener.

I guess a few volunteers can't backport security fixes to all software in the world after all.

Indeed they can’t. So don’t depend on that.

See https://security-tracker.debian.org/tracker/status/release/s...

Is this a 'chromium is not a priority because google' ?

Or maybe lack of resources and the maintainer needs help.

Probably google. Chromium has made the decision to bundle all their dependencies instead of play nice with system libraries. Which means you either need to re-roll all of chromium when something is found, or you need to undo google's efforts. I don't blame distributions for refusing to give chromium poor support - it is intentionally not playing nice.

Yeah because when your software is at the scale of Chrome, "playing nice" with system libraries as you put it means your software is unreliable, difficult to debug and reason about. You want as few unbundled dependencies as possible.

That is their excuse, but I don't buy it. Plenty of other projects manage just fine.

Is that the case for all distros? For Arch I see only libEGL/libGLESv2 are bundled, every other library is an external dependancy: https://archlinux.org/packages/extra/x86_64/chromium/

All is far too strong to apply when there are as many different distributions as their are. Arch must have done the work to separate out all those dependencies, Debian has also stated their position is dependencies must be separated out as well.

How many of those vulnerabilities have patches available ?

From what I can tell, the problem with these packages is that the security fixes need to be backported into earlier versions of packages because upstream fixed them in major version releases.

Chromium 90 does not contain all security fixes found in Chromium 93 so there are tons of CVEs open on Debian systems still rocking Chromium 90.

Most packages have fixes available but Debian doesn't have the manpower to backport every single security fix for every single package. This is a result of the way their project is structured: they guarantee that no major software updates happen within Debian releases, helping you get a completely stable system, but that comes at the cost of an incredible amount of work for the Debian maintainers.

Debian chooses to modify or repackage upstream versions for compatibility or branding purposes (to the ire of many open source developers, like notably that guy that made XScreenSaver. I'd link to his rant about it, but his website shows some angry rant when HN is in the referer header...) That means that maintainers still need to do manual work even when upstream has already provided them with a fix for the latest version supported in Debian.

This is why I prefer to run packages from repositories maintained by the developers themselves rather than relying on Debian's maintainers. The risk of needing to update config or check for breaking changes is much higher, but the security risk and patch cycle length is much lower. Even for browsers that release actively-abused 0day patches it can take up to a day or longer for some distributions to update their packages.

> XScreenSaver. I'd link to his rant about it, but his website shows some angry rant when HN is in the referer header.

Here’s the link I think: https://www.jwz.org/blog/2016/04/i-would-like-debian-to-stop...

This is why I run OpenSuse Tumbleweed as my baseos and the software I need to run in containers.

https://microos.opensuse.org/

If anything, Cannonical is aligning with mainstream in recent years: upstart -> systemd, unity -> gnome, mir -> wayland

New things that are Canonical specific are netplan and snap. I think snap is solving software packaging in Linux. If anything, I wish that snap brand stores were more affordable.

It would seem that snap brand stores are essentially hosted private repos something one could do for Ubuntu for as little as $5 a month. Why not just use those?

Use flatpack

Use AppImage + firejail (optionally, to fully sandbox AppImage)

I want to like AppImage, but it is just unreasonable that there is no built-in way to trivially install a .desktop file for a given AppImage I've downloaded.

> there is no built-in way to trivially install a .desktop file for a given AppImage I've downloaded

Here it is.[0,1]

[0] https://github.com/TheAssassin/AppImageLauncher

[1] https://docs.appimage.org/reference/desktop-integration.html

I've tried AppImage, Flatpack, and Snap, and AppImage is the only one that approaches tolerable.

Tried Nixpkgs?

Still dumping snapd into their server distro for some reason though.

what's wrong with snap? is it that it needs a deamon?

Four issues with Snap: 1) You don't have control over how it updates packages. By default it can eat your LTE if you run your laptop after a while, for example. 2) It's eating into apt world. They are migrating programs into it which could've been usual apt packages. 3) It normalized longer startup times. 4) There are still issues with file system interop etc, but I personally can't provide an example.

> There are still issues with file system interop etc, but I personally can't provide an example.

Is that why my firefox downloads file into a tmp directory instead of ~/Downloads?

I also used to have vscode unable to sudo but it's no longer the case, maybe it's flatpak now, haven't checked

I’ve seen that quote so many times used in forums and I find it annoyingly condescending. Actually I think that kind of attitudes are one of the worst things in the linux community in general. Anyways, I used to stupidly joke back saying that “Debian is a code word that means: no relevant contribution to the linux ecosystem for the last 15 years”.

I’m a long time Ubuntu user and haven’t really shopped for other distros. Any recommendations besides Debian?

Fedora, Arch. You can basically look for any popular distro, they're all working very well if you're not entirely out of your depth wrt Linux

Agreed. I've done a lot of Ubuntu and Arch. Arch is fantastic. I recently have been trying out Fedora and I have been enjoying it a lot.

Yeah I switched to Fedora recently, with pipewire setup by default its really easy to get great audio performance out of the box, I used to have to build custom kernels for jackd.

openSuSE Leap is nice if you don't have anything against rpms. Upgrades just work and the distribution has an 18 month support window. The packages are pretty polished too. We're currently using that and Debian and also Ubuntu 18 on the developer workstations, which we'll switch to Debian 11.

PopOS. Ubuntu with better power management and a tilling WM.

I’ve been really happy with Mint. It’s based on Ubuntu internally, but it feels light and fast.

I like Fedora.

Manjaro seems pretty popular now. It's based in Arch with rolling releases and everything but gives a good experience out of the box while Arch is a full time job to maintain

> Arch is a full time job to maintain

I've never understood that sentiment. Are there things I don't know about I should be doing?

I installed Arch probably four years ago on my laptop, and have never had to do anything but install updates and read the announcements on archlinux.org since.

I do understand the appeal of Manjaro - I did use it briefly when it first came out - but I don't see how maintaining Arch Linux would appear as being particularly complicated. I literally don't do anything with it I wouldn't do with any other OS.

The fact that any update may break your system if you're not careful is quite stressful when you're working. It's only a few hours from time to time, but when work is pilling up "just for an update" it feels like days.

Also, it seems to me that ArchLinux had less very impactfull changes in the past years because it has matured quite a lot. It's only an impression though!

If you like (or are okay with) GNOME, I'd recommend giving Fedora a try.

Been using for a few years now and it has been the closest thing to "set up and forget" to me (I needed to install some codecs to play H.264/HEVC video). Painless upgrades, decent software catalog... It has been extremely reliable. Highly recommend it.

My home server uses Fedora. I've upgraded it on every release, from Fedora 29 all the way to 34 today. I've been dailying the 35 beta on my desktop and it's been great so far as well.

Mint is arguably better at being what Ubuntu was originally intended to be. And is still based on Ubuntu, so all your mad apt-get skills still apply, the packages are readily available etc.

Ubuntu is a commercial distro. They have their own infra, they have their own security team, they have large amounts of reliable funding and contracts.

Mint is worked by a few people, had several large security flaws including not distributing security updates timely. They had issues in the past with their ISO being hacked.

I can empathize with the whole mint, small time dev-base stuff. It just doesn't make sense to me compared with just going straight ubuntu + cinnamon.

KDE Neon. Based on Ubuntu but with a UI built by and for actual users, not a UI built by experts for grandmothers.

If you want to use a multitouch trackpad fluently, Elementary is is the only game in town. It has macOS-level support which is pretty cool.

How do they get it? Can't those tools also work in Debian or Gentoo? What's the magic sauce? Kernel patches?

https://youtu.be/aKlmV-EiqVk?t=45

Can't edit my comment but thanks for pointing this out. For anyone not wanting to watch the video, apparently this release includes trackpad multitouch support comparable to elementary.

It looks like Ubuntu is now comparable to Elementary. I'm going to be trying this out ASAP. Ubuntu with Wayland does a much better job with high and mixed DPI display setups. Maybe now I won't have to choose between running my 4k display at full resolution and using my trackpad.

Assuming I don't really give a crap about what mechanism is used to update Firefox, and just want a browser that works, what am I missing out on by sticking with Ubuntu?

It's always been my OS of choice because I don't really care about my OS. Is there another distro that is similarly easy for me to get up and running With current versions of Firefox, chrome, vscode, and docker, and on whatever random hardware I happen to have available?

I use Fedora personally for these exact reasons.

As someone who left Ubuntu at Hardy Heron (8.04), what are the problems with Ubuntu these days ? I know they tried to do desktop differently but failed to convince other distros and projects to change paradigms but it seems to me they are back to more common infrastructure now.

Reply on news.ycombinator.com