Comment by hexfish | Hacker News Reader

Comment by hexfish | Hacker News Reader

Parent Full thread

Because in most enterprise environments it's a welcome property to keep security updates separate from feature updates, which is not something rolling distro's provide, as they just follow upstream as fast as possible.

Say my enterprise application is built upon the API (in an abstract sense, if you will) of package xyz, version 1.0. And then xyz, version 2.0 comes out.

I would have to rebuild my enterprise application to be compatible with API 2 and I don't have the resources nor the incentive for that because I don't need API 2. Then a vulnerability gets reported in both xyz version 1.0 and 2.0 but xyz's maintainers only patch 2.0 (as 2.0.1).

In that case I am very happy that non-rolling (enterprisey) distro's like Ubuntu, CentOS, Redhat etc backport that security patch so I can keep running xyz version 1 (or rather 1.0.0-1 or something like that). Where most rolling distro's would just 'force' you to upgrade to 2.0.1.

Hope my explanation makes sense.

First of all, many rolling release distros don’t follow upstream as fast as possible—there’s often some testing window.

People go on and on about backported security patches and stability, but I’ve had to handle so many buggy patches or issues that never got a backported fix that I now think this is basically a fantasy. The distro maintainers just don’t have the time (or experience with all the software they ship!) to backport patches for every single issue. I’d really rather get a fix by the actual software maintainer than a year-old mystery meat version that still has a bunch of known non security bugs fixed in upstream that the distro maintainers don’t care about.

Even worse, being able to stay on essentially outdated software puts a lot of organizations into a tough spot when their LTS version finally becomes unsupported. Practice makes perfect, and I think lots of small, regular updates result in a lot less pain than a mega-update every few years (really: I’ve had to manage one of these more than once, and it’s a total nightmare figuring out which of 1000 changes in the new LTS version caused a performance regression or something).

> distros don’t follow upstream as fast as possible

Well yes, the testing is of course part of the 'as fast as possible' part. But I could've made that more clear indeed.

> many buggy patches or issues that never got a backported

I have yet to see those in CentOS. But I guess we won't be seeing a lot of CentOS at all in the foreseeable future :p

> many buggy patches or issues that never got a backported

I feel like thats mostly on them. There is a huge temporal overlap between LTS versions and you should have plenty of time to test. I think I'd rather dedicate one month every year to fully test and then roll out a new LTS version than be interupted by unexpected updates at random intervals.

That being said: What a boring job it must be to backport security patches all day.

Reply on news.ycombinator.com