The following security updates require Ubuntu Pro with ‘esm-apps’ enabled

There could easily be downside. It's free for 5 machines for now. However, the big risk IMO is if relying on Ubuntu for security patches becomes a normal thing.

In fact, it could even go as far as having Ubuntu make deals with software developers to maintain security patches for software past a certain lifecycle (ex: 2-3 years). By doing that, Ubuntu could discourage projects from running their own LTS programs and all of a sudden Ubuntu would become the only viable LTS distro.

Open source means nothing. Whoever controls the development effort is the one who decides how open software really is. If Ubuntu manages security patches for all the LTS packages, the only choice of LTS distro is Ubuntu and there's no way on earth they'll keep any kind of significant free offer available if that happens.

Instead I have to raise a separate business case about why I want to pay for support, manage a separate line item in my budget, etc, etc, that's all tedious, so I don't bother.

If that's true, it means RHELs and RHEL clones have better security coverage.

Edit: No they don't, these security updates are for Ubuntu universe, which is basically ubuntus version of rpmfusion.

Naive question: I've got ubuntu running on servers (mostly just shared files and computer) and some cloud gpu machines. Are these affected as well? As in the ubuntu images that come from aws et al are presumably not "pro" so they won't be properly watchable?

As an aside, what a rip-off. I'm generally hesitant to use free tools from for-profit companies for fear of how they'll later try and monetize, and this is a pretty good case of a company deciding to lure people in then do something really scummy

Don't be put off by the Arch-based nature of the OS - since both Endeavour and Manjaro have installers, they bootstrap your system's drivers, and all.

I've found maintenance to not be too overwhelming, and Arch's wiki is top-notch. When I used other distros like Gentoo, I sometimes found myself reacing the Arch wiki...

Package management isn't too different from using apt, synaptic, or the app store if you use the right tools:

Command-line:

- Pacman: for precompiled official packages

- Yay : Automagically compiles community-ported third-party applications

GUI:

- Pamac: Look it up - it's a lot like Ubuntu's "App Store"

The caveat here is that I'm an experienced Ubuntu/Debian user that moved to Gentoo for a while.

While using Gentoo, I got tired of the systemd migration nightmare and returned to Ubuntu to find the nightmare of Snapd and poorly-sandboxed applications in their community repo.

I've only used Arch for about a month, but after using Gentoo and Ubuntu, I think I'm staying here for a while. The kernels are brand-new and the GPU driver performance is at least 2x what I was getting in Ubuntu. With the derivatives, there's no reason to bootstrap an Arch system from the kernel framebuffer, like the olden days of Gentoo and Slack.

Will most likely move over to Debian instead of "upgrading" to 20.04LTS.

But LTS really helped keep fuss even lower. I remember buying my first Ubuntu laptop from Dell in disbelief. No fuss, worked for years, no issues.

Right now I gather Ubuntu has a lot of commerical runway and partnership to leverage. Community runway is going to be shorter but there are still (as I understand it) workarounds for just about every significant issue people have with the distro.

What's concerning is that workarounds are essentially the same thing as fuss, for a lot of users out there.

Not sure about how they show things which are in "universe" and therefore unsupported. Packages like: Python, Perl, Go, Docker, and more...

If those aren't included in the base OS, that is a bit concerning.

It's actually pretty bad. If you're running Ubuntu anywhere there's a bit of bureaucracy, like a government or large business, you get backed into a corner.

You can never use any of the packages from 'universe' unless you're buying Ubuntu Pro because if you ever get hit with an exploit where there was a patch available, regardless of the circumstances, you'll get crucified.

The insurance company, admin staff, ambitious peers, security analysts, etc. will bury you for not patching a known vulnerability. This is the end of Ubuntu's 'universe' repo for businesses that can't afford $500/year/server. It's just that no one has realized it yet.

I have to challenge that. Their last revenue numbers that I can find (2020) indicate a moderate profit on a headcount of about 500 people.

They've grown pretty well, but that's not the same as profited. Canonical targeted the gaps that Red Hat left when it moved from Red Hat Linux -> Fedora / RHEL, and ate up a lot of the Linux market and grew the pie a bit in terms of people using Linux.

But Canonical has never been making money hand over fist. Their finances aren't public but AFAIK they've largely been in the red or breaking even. Their 2020 financial statement indicated profit for 2020 but loss in 2019.

An interview with TechCrunch last year[1] suggested their revenue was "$175m last year" -- that's a small fraction of Red Hat's revenue and less than SUSE if I'm not mistaken.

Note I'm only responding to their push for Ubuntu Pro - if they're also not pushing patches back upstream or playing games like that, that's a different story. But that's not about making them available vs. making them convenient.

[1] https://techcrunch.com/2022/04/21/canonical-now-hopes-to-ipo...

The best part of Linux is this is totally avoidable (less so if you're in a strict corporate environment where Ubuntu is the only option from IT)

    > Subscription  Quantity  Billing        Total
    > Ubuntu Pro    1         Billed Yearly  $500.00

* There's an app in the Universe repository, which consists of software that is not formally supported by Canonical at all, which has security updates that are actually available from Canonical if you're an Ubuntu Pro subscriber.

* It's barely an issue: I registered with Ubuntu online and got a free lifetime license for 5 machines, so it's no biggie.

I tried the same and got a minimum quote of $25 a year I think?

Has anyone figured out where this free option might be?

If they didn't have this, the security would be lower for everyone.

They have not taken anything away from anyone here, they have only provided extra services to people who pay.

They communicate this poorly, obviously. And it needs to be made clear that they are not withholding community patches, only contributing for a price priority patches to previously community-only packages.

A. Packages just get updates. B. The official repos are entirely supported but smaller.

Ubuntu does the weird split of "It is official but we don't support it". And now that they monetized it you are in a situation where its easy to install something, because they offer it, and then later they hold an update hostage.

Wow. I completely missed that was per year. I thought it was a one time purchase and thought that seemed a bit high. MS sells Server Essentials for up to 10 cores for $500 and that includes use on 1 VM as well AFAIK (don't take that as licensing advice).

> Alongside Ubuntu itself, each of these applications is fully security patched for high and critical CVEs for 10 years. This enables organisations to take advantage of a secure and stable open-source ecosystem with none of the usual maintenance burden! No need to worry about scanning, applying, and testing the latest upstream security updates.

Seems Ubuntu was largely popular with devs and the masses due to it's ease of use back in the day. Never understood why more didn't just go with Fedora back then.

If all they did was patch upstream, you’d have to wait longer for the fix. I don’t see how that solution is unambiguously better.

It's basically a "fuck you pay me" message, with the subtext of "it'd be a shame if someone was to hack that vulnerable program I just gave you"