Hacker News Reader

Comment by pmontra | Hacker News Reader

Honest question. What do they do that Debian or Ubuntu don't?

For openSuSe, their open build service is awesome. You can create packages in your personal repos and submit to the official repo in one click. Though zypper (suse package manager) download packages serially and takes a lot of time during upgrades.

OBS can also build packages for many other distributions (including Debian derivatives) and automatically maintain repositories for them, and even supports using one universal RPM spec file to produce both debs and rpms (and some other formats) if you want it.

So you won't have to change distributions to take advantage of it. Really wish the service was more widely known.

OpenSUSE Tumbleweed is a rolling-release distro, so it has up-to-date packages unlike Debian where the packages are years out-of-date. This should make stuff like flatpaks and snaps much less necessary, since these are basically work-arounds for ancient packages.

Also, KDE seems to be very well supported on OpenSUSE, whereas it's more of an afterthought in most other distros, including Ubuntu and Debian.

Major advantage of Fedora is being closer to the upstream sources, both in terms of freshness and in terms of not meddling with libs or similar. Debian patches lead to several possible exploits over the last few years.

Fedora removes elliptic curve algorithms from the source code level [1] and disables hardware acceleration for H.264 / H.265 [2].

[1] https://bugzilla.redhat.com/show_bug.cgi?id=615372

[2] https://www.phoronix.com/news/Fedora-Disable-Bad-VA-API

Yes, distributing non-free, patented code that requires a license, requires a license. The same goes for Debian actually[1], including blocking requests and removing packages that were included before by mistake.

I would even dare say that this is another point for Fedora, enabling https://rpmfusion.org/ is a one-liner and feels entirely native, never a broken package.

[1] https://www.debian.org/legal/patent

RPM Fusion does not give me uncrippled crypto libraries. It’s caused by their paranoia about export restrictions, not patents.

> Debian patches lead to several possible exploits over the last few years.

Which ones? There was the OpenSSL entropy bug, of course, but that was 1. in 2006, and 2. run by upstream so feels a bit unfair.

I have to admit that I never compiled a list of this type and it seems exceedingly difficult to find useful search results. I couldn't dig up the examples I had in mind from the last 2 years, but stumbled upon others I didn't know of yet in turn, e.g. RCE via Redis, no special config required:

> This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking

https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rc...

Basically they have up-to-date KDE desktop environment unlike the obsolete version in Debian. Ubuntu always lags behind too.

Reply on news.ycombinator.com