Hacker News Reader

Comment by Wronnay | Hacker News Reader

Why should any company buy this? Does that mean, that these security updates are exclusive to Ubuntu Pro and everybody else won't get Vulnerabilities fixed?

Aren't security upgrades anyway getting deployed - I mean, if Canonical would hold bug fixes for Vulnerabilities back, then obviously the community would switch to a different Linux Distro?

Especially this sentence makes me wondering: "Many zero-day vulnerabilities addressed under embargo, with critical CVEs patched in less than 24h on average"

=> This sounds like Canonical holds back zero-day vulnerabilities for not-paying users!

View on HN

From TFA:

> Ubuntu Pro expands security coverage for critical, high and medium Common Vulnerabilities and Exposures (CVEs) to thousands of applications and toolchains, including Ansible, Apache Tomcat, Apache Zookeeper, Docker, Drupal, Nagios, Node.js, phpMyAdmin, Puppet, PowerDNS, Python 2, Redis, Rust, WordPress, and more.

So sounds like coverage of a bunch of stuff in their Universe repository that is not part of the base system.

Though I found my own thing to whinge about, on https://ubuntu.com/security:

> Ubuntu [...] includes access to:

> - ...

> - Knowledge Base: a private archive of expert-written articles and tutorials

Wait what?

> > - Knowledge Base: a private archive

Common thing for enterprise customers, I can not speak for Ubuntu but usually they are private because they are filled with bad articles and tutorials that no one would pay for. Sounds good though.

Ubuntu LTS is only 5 years, and only for the core (the server stuff really, the 'main' and 'restricted' repos). Desktop and other 'universe' stuff has a shorter time frame.

After 5 years, companies wanting to keep running older versions of the OS require 3rd party security updates at a minimum for compliance issues, even if they think they can protect themselves and their customers without it. This was Ubuntu Advantage and Extended Security Maintenance (ESM). And now it seems Ubuntu Pro. UA lots of people got for free, either due to only needing a few seats or it being included with their cloud. But bigger shops with their own hardware would need to pay, or get to explain to the media why they didn't bother if they get breached.

Souns like it's security updates for otherwise out of support versions, 16.04, like MS sells (sold?) for Windows XP.

Hopefully it just means extended duration for getting patches. If not… yikes.

Reply on news.ycombinator.com