I'm working on a conference talk in which I will discuss the trade-offs inherent to long term releases.
Specifically: distributing software for a longer period than it is maintained upstream is very labor intensive, and different long-term systems approach the problem in different ways. RHEL starts with Fedora but removes ~90% of the packages and features in order to reduce the labor costs over the life of a release. Ubuntu similarly starts with Debian but splits repositories into a small "main" repo component that they promise to maintain and a large "universe" component that they document as merely a snapshot for which they do not promise any updates. Debian is probably effectively similar to Ubuntu, but they don't divide their repo the same way so it's hard to make any clear statements about user expectation of patch coverage over the distribution.
I am curious about how the maintainers of systems derived from Ubuntu LTS releases think about security risks and patch coverage.
Are there any packages in "universe" that are used in a default installation of your desktop? Do you monitor those packages for new CVEs?
Are there any packages in "universe" that you patch because your users would otherwise be at risk? Do you update those packages by backporting patches or by rebasing to new upstream releases?
Do you provide guidance to users about the packages they install from the Ubuntu "universe" repo collection using apt?
Do you recommend using software sources like Flatpak or Snap to give users access to application releases that are maintained and get security patches?
Is there anything else that you want users to know about your approach to vulnerability remediation or related security topics?
If this is not the best place to ask a question of the maintainers, where should I ask?
Specifically: distributing software for a longer period than it is maintained upstream is very labor intensive, and different long-term systems approach the problem in different ways. RHEL starts with Fedora but removes ~90% of the packages and features in order to reduce the labor costs over the life of a release. Ubuntu similarly starts with Debian but splits repositories into a small "main" repo component that they promise to maintain and a large "universe" component that they document as merely a snapshot for which they do not promise any updates. Debian is probably effectively similar to Ubuntu, but they don't divide their repo the same way so it's hard to make any clear statements about user expectation of patch coverage over the distribution.
I am curious about how the maintainers of systems derived from Ubuntu LTS releases think about security risks and patch coverage.
Are there any packages in "universe" that are used in a default installation of your desktop? Do you monitor those packages for new CVEs?
Are there any packages in "universe" that you patch because your users would otherwise be at risk? Do you update those packages by backporting patches or by rebasing to new upstream releases?
Do you provide guidance to users about the packages they install from the Ubuntu "universe" repo collection using apt?
Do you recommend using software sources like Flatpak or Snap to give users access to application releases that are maintained and get security patches?
Is there anything else that you want users to know about your approach to vulnerability remediation or related security topics?
If this is not the best place to ask a question of the maintainers, where should I ask?
Comment