Ubuntu Security Updates Are a Confusing Mess

https://gld.mcphail.uk/posts/ubuntu-security-updates-are-a-confusing-mess/

by popey • 2 years ago

88 38 2 years ago

gld.mcphail.uk

I'd argue we wouldn't have Snap [for the better] if their LTS releases weren't visually bound to years... saving overhead they regularly create for cosmetic reasons.

Wouldn't have to create it to consolidate platforms if they stopped making them so often!

They have three concurrent LTS releases when they need one. Maybe two. 18.04 is the python2 of distributions. Let it go.

Having worked in several places that relied on it... ESM is being the bad kind of enabler.

Fedora handles "The Snap Problem" -- many target distributions -- with 'fedpkg' and 'mock'. Software and machines on the build side. Not by degrading the end user experience. They do participate with Flatpak... but that's peer pressure more than anything.

Flatpak is more well-rounded IMO. Probably from being the broader answer. Maybe this all doesn't make an argument. Just a bunch of statements. I don't know.

Back on topic: I wonder what all of this Canonical stuff in particular is for/leads to. New software isn't scary; 'just' plan/test. It becomes scary when you get lazy here... so accept your involvement.

Dylan168073• 2 years ago

They have three concurrent LTS releases when they need one. Maybe two. 18.04 is the python2 of distributions. Let it go.
Having worked in several places that relied on it... ESM is being the bad kind of enabler.

The business proposition is 10 years of support with minimal package changes. Are you asking them to just stop selling that product?

Fewer LTS releases wouldn't change that core question, since if they never had a 2018 LTS release those users would be on the 2016 release instead.

bravetraveler4• 2 years ago

I suppose I doubt the proposition of '10 year support' - admittedly I haven't done anyone else's job for them.

I don't know if that necessarily means stop selling the product... but tighten up the terms, I guess? Anyone choosing to stay on something that old has chosen those gremlins.

The build of systemd and firewalld on 18.04 are both categorically broken. I don't know whatever people are solving with that old release (and Canonical in support)... but it's less than what those two things do for me when working properly.

The illusion of support for something so decrepit creates more problems than it solves in my experience. Either bite the bullet and modernize/upgrade... or keep playing with the unsupported sands of time

Suppafly• 2 years ago

Is it not possible to fix the one package from the debian sources vs waiting for ubuntu to allow him to get it from them?

lmz2• 2 years ago

It's possible to fix anything from the sources but I guess the Tomcat version in 22.04 didn't have a corresponding stable Debian version? (vs. the 20.04 version)

lmz2• 2 years ago

Confirmed, the tomcat 9.0.58 in Ubuntu 22.04 is not in bookworm/stable (which is on 9.0.70) or bullseye/oldstable (which is on 9.0.43), and the 9.0.31 in Ubuntu 20.04 is the same as the version in Debian buster.

juujian• 2 years ago

Ubuntu is merely reusing apt to connect to its own repositories. You could manually install packages from Debian's repositories, but it's probably inadvisable.

frankjr3• 2 years ago

I don't care they're gating this behind a subscription but the fact that they won't even tell you that you're missing an important security update? That's bad. I wonder how many people think they are fully up to date while being vulnerable to known bugs.

ElectricSpoon• 2 years ago

They do tell you that you are missing now. On ubuntu 24.04, apt now reports/nags me about security updates behind esm-apps.

They also publish an oval xml for use with openscap tools to get a list of unpatched CVEs. The issue is not enough people know about those tools. https://security-metadata.canonical.com/oval/

frankjr3• 2 years ago

Aha, thanks. I'm trying to look up the CVE on https://ubuntu.com/security/notices and the site's search responds with "504 Gateway Time-out" or "500: Server error". Come on Ubuntu.

captn3m02• 2 years ago

They finally agreed to publish OSV data in addition to OVAL. OVAL XML files are terrible to use, and OSV is amazing in comparison, so this will get more tool adoption.

rightbyte• 2 years ago

I don't care they're gating this behind a subscription

I rather not have them push an ad to my face when I open the settings.

I had to install Ubuntu on an embedded board last week and the "Ubuntu Pro" ad is like a greyed out tab in the settings widget if I remember correctly. Worse than the Amazon ad they had some decade ago.

dgfitz• 2 years ago

I have recently had a lot of unfortunate interactions with 24.04, and it really makes me hate debians.

arjvik• 2 years ago

If I was looking for a distro with paid support (a la RHEL/Ubuntu) that's also not incredibly behind bleeding edge (maybe not as bleeding edge as Arch, but also not running patched-to-hell-and-back software like Ubuntu), what are my options?

Thankfully I'm not personally looking for this at the moment, I'm more than happy being my own sysadmin and running anything from Arch to Fedora CoreOS to OpenSUSE on my machines.

brylie• 2 years ago

I don’t know if it meets all of your criteria but SUSE might be an option:

https://www.suse.com/products/server/

SSLy3• 2 years ago

On desktop/laptop? Only Arch. On servers I'd say RHEL/Rocky (don't disable selinux!) or SuSE; and the deployed services in podman or incus.

ZhongXina3• 2 years ago

I wish people would stop recommending Rocky. It's a ticking time bomb IMHO caused by their decision to not play nicely with Red Hat and go for questionable tactics like renting temporary RHEL instances to download premade source packages, instead of working together as RH asked them to do. Anybody reading this, do yourself a favor and use Alma, or skip the RHEL ecosystem altogether if you don't absolutely need it.

Otherwise you're building on an operating system which rebuilds a commercial upstream while explicitly refusing to follow that upstream's rules. IBM has lots of experienced lawyers, as I've heard.

It's also slower at releasing updates, including security updates.

------

Sorry SSLy, I can't reply to you directly because I'm rate limited, it's very late here, and I'm not waiting for the rate limit to expire. So here's my reply:

I think previous decisions made by IBM have shown that they're fine at burning some community goodwill for short-term profit. People were called paranoid for worrying about the future of CentOS when it was taken up by Red Hat for "improved maintenance", and look where we are now.

Maybe you're right, but I personally wouldn't want to build anything serious on top of that "maybe". If something happens, lateral migration should theoretically work, of course..

https://almalinux.org/elevate

frankjr3• 2 years ago

I've heard good things about AlmaLinux but I haven't used it personally.

https://almalinux.org

ZhongXina3• 2 years ago

RHEL ecosystem is no less patched than Debian and its derivatives. Especially the kernel has only some resemblance to its stated version.

ZhongXina3• 2 years ago

afaik, your want of relatively fresh software with few patches excludes pretty much everything there is, except for really niche stuff. All other major options with good commercial support have been mentioned by siblings; I'll add Debian + Freexian to the list.

https://www.freexian.com

n3storm• 2 years ago

Ubuntu is reselling Debian, once they made it well, now I don't know

01HNNWZ0MV43FF• 2 years ago

I'm hard-pressed to name a feature that Ubuntu has that isn't part of Debian. But it's what people like, so I package for Ubuntu :/

sebazzz• 2 years ago

Debian packages also work for Ubuntu, no?

yencabulator• 2 years ago

It used to be that Ubuntu had more resources to test against various laptop hardware. These days, it's much easier to buy hardware that just works with any kernel.

Unless you intend to pay for support, I see no reason to not prefer Debian in 2024.

captn3m02• 2 years ago

I maintain https://endoflife.date/ubuntu. Ubuntu security policies are indeed a hot mess, and opaquely documented on their own website. I use it as an example of how not to document your support policies at https://endoflife.date/recommendations.

At one point Ubuntu changed the EOL tables on their Wiki from 5 years to 10 with no explanation about applicability/ESM - just calling it LTS.

It is among the longest pages on our website.

cosmin800• 2 years ago

Ubuntu is a mess, there you go I fixed your title, joke but no joke, is real.

BeefySwain• 2 years ago

...what are my options? ...Maybe it is time to go back to Debian, as they seem to release these fixes to their users?

Curious if this would actually be a solution. They state that fixes in Debian are down-streamed regardless of support, so if this fix wasn't down-streamed, then why would it be in Debian ?

capitainenemo• 2 years ago

The fix is in debian (and in devian derivatives like devuan) https://security-tracker.debian.org/tracker/CVE-2022-42252

As for why it isn't in Ubuntu 22.04 - perhaps because the Ubuntu release schedule does not match debian's. Debian buster was released in september 2022 - Ubuntu's April tagging is probably based off of the prior debian release which only gets critical updates.

hs86• 2 years ago

Most Ubuntu users don't know that Canonical only supports the main repository for free.

To my knowledge, only some comments hidden in /etc/apt/sources.list mention this, but the more honest approach would be to warn all users when they try to `apt install foo` some package from universe/multiverse. Or do it like RHEL with their EPEL repo and disable it by default.

But I guess they would have never gotten this popular if people saw that Ubuntu is only a few thousand packages compared to Debian's tens of thousands.

markshuttle• 2 years ago

Your free personal Ubuntu Pro subscription does in fact cover as many VMs and containers as you can run on up to five personal machines, as the OP well knows. I like that we make Ubuntu Pro, including universe updates, free for anyone running at small scale.

greylumpydino• 2 years ago

Thanks for the reply and the correction. I've updated the post to reflect this. I'm sure it will be helpful for others, as the UI doesn't reflect that these containers do not come out of the overall allocation. As you'll see in the screenshot I've added, it looks as if these are being counted as 8 physical machines against 5 tokens.

thinkst• 2 years ago

The updates in universe are definitely best effort.

We were paying for Ubuntu Pro through an AWS subscription on 2k EC2 instances, and could not get Canonical to update a package with a CVSS 7.8 in the 18.04 LTS.

We've moved off Ubuntu Pro as a result. Blogged it at https://blog.thinkst.com/2024/07/unobtrusively-upgrading-ubu...

Ubuntu Security Updates Are a Confusing Mess

Related Stories