Hacker News Reader

Comment by cassianoleal | Hacker News Reader

> It made it to production, for a long time

Did it? At least in Debian, where it was found in the first place, it only existed in sid/unstable and I think perhaps in testing. It never made it into stable which is the only thing you should be running on a production system.

I think in Fedora it was also only in a testing or RC of the next stable version but I'm not sure. Also unsure about others. I have seen several distros putting out advisories (Gentoo, Arch, OpenSuse and more) but I didn't go into the specifics.

View on HN

I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.

Fortunately, it didn’t make it into an Ubuntu release: https://discourse.ubuntu.com/t/xz-liblzma-security-update/43...

Though it was frighteningly close, 24.04 is scheduled to be released on April 25.

Wow, ok, that's close. I wonder how many have actually made it.

My impression is that it did not get into latest Ubuntu, they were in the process of trying though.

The end goal seems to have been to get it into the LTS releases of rhel and Ubuntu. Since this was a valuable it's probably something kept around for when other methods fail. I doubt it would be used before the really valuable systems are compromised (rhel and Ubuntu in cloud and governments)

I don't personally know anyone who would run any Debian release that's not stable on production systems. On your desktop? Fine. I do it myself. On a server, with ports open to the public Internet that's a big nope.

There's nothing wrong with Debian stable having years-old packages either. In any case:

> The current "stable" distribution of Debian is version 12, codenamed bookworm. It was initially released as version 12.0 on June 10th, 2023 and its latest update, version 12.5, was released on February 10th, 2024.

https://www.debian.org/releases/

That's just over 1 year. Sure, packages themselves will be older than that since they take some time soaking frozen in testing before they become part of stable but that's generally a good thing.

In any case, if there's pressing need for some newer packages, it's always possible to use apt pinning to pull those on top of a stable base.

I didn't say there's anything wrong, I meant that choosing the OS distribution with the oldest packages isn't an indication for how widespread the distribution of this package was.

I was initially responding to

> > It made it to production, for a long time

I never said it didn't make it to production. I was asking if that's the case, and giving one data point.

It apparently didn't make it into Ubuntu LTS either, so there's another one.

If you have information that proves or disproves either point, please present it.

Reply on news.ycombinator.com