←back to thread

Debian bookworm live images now reproducible

(lwn.net)
764 points bertman | 2 comments | 26 Mar 25 17:22 UTC | HN request time: 0.024s | source
Show context
jcmfernandes ◴[26 Mar 25 19:14 UTC] No.43485833[source]▶
Insane effort. This sounded like a pipe dream just a couple of years ago. Congrats to everyone involved, especially to those who drove the effort.
replies(1): >>43487674 #
Joel_Mckay ◴[26 Mar 25 21:39 UTC] No.43487674[source]▶
The Debian group is admirable, and have positively changed the standards for OS design several times. Reminds me I should donate to their coffee fund around tax time =3
replies(2): >>43489910 #>>43497816 #
alfiedotwtf ◴[27 Mar 25 02:45 UTC] No.43489910[source]▶
Exactly!

I’ve said it many times and I’ll repeat it here - Debian will be one of the few Linux distros we have right now, that will still exist 100 years from now.

Yea, it’s not as modern in terms of versioning and risk compared to the likes of Arch, but that’s also a feature!

replies(3): >>43490181 #>>43490648 #>>43491565 #
vbezhenar ◴[27 Mar 25 08:52 UTC] No.43491565[source]▶
I feel more safe using Arch, compared to Debian. Debian adds so much of their patches on top of original software, that the result is hardly resembles the original. Arch just ships original code almost always. And I trust much more to the original developers, than Debian maintainers.
replies(2): >>43491752 #>>43498222 #
freedomben ◴[27 Mar 25 21:10 UTC] No.43498222[source]▶
I love Debian, but this is a genuine deal that many people don't know about. It also compounds if you're on Ubuntu as sometimes Canonical adds their own patches too. If you're just using Debian as a base OS to serve your own software, it doesn't matter as much but still does somewhat. It's not unusual for Debian-specific patches to be applied by the package maintainers in order to fix build errors, mismatched dependencies, etc. Most of the time those patches are harmless, but sometimes they are not. There have been security vulnerabilities for example that only existed in the Debian-based package of software. No distro is perfect and I don't intend this as a criticism of Debian (as they have legitimate reasons for doing what they do), and no distro (not even Arch) ships everything without any patches, but in my years of experience I've bumped my head on this in Debian several times.
replies(1): >>43498293 #
progval ◴[27 Mar 25 21:17 UTC] No.43498293[source]▶
> There have been security vulnerabilities for example that only existed in the Debian-based package of software.

Any examples more recent than CVE-2008-0166?

replies(1): >>43498499 #
1. freedomben ◴[27 Mar 25 21:40 UTC] No.43498499{3}[source]▶
Currently on mobile and going from memory, but I remember having to push out quick patches for something around 2020-ish or late 2010s? The tip of my tongue says it was a use-after-free vuln in a patch to openssl, but I can't remember with confidence. I'll see if I can find it once I get home.

Worth noting lest I give the wrong impression, I don't think security is a reason to avoid Debian. For me the hacked up kernels and old packages have been much more the pain points, though I mostly stopped doing that work a few years ago. As a regular user (unless you're compiling lots of software yourself) it's a non-issue

replies(1): >>43499631 #
2. Joel_Mckay ◴[27 Mar 25 23:49 UTC] No.43499631[source]▶
In general, most responsibly reported CVE allow several weeks for the patch fixes to propagate into the ecosystems before public disclosure.

Once an OS is no longer actively supported, it will begin to accumulate known problems if the attack surface is large.

Thus, a legacy complex-monolith or Desktop host often rots quicker than a bag of avocados. =3