Hacker News Reader

Given the claim "Ubuntu has a number of vulnerabilities that are patched in Debian," I am unsure of how "Debian has unpatched vulnerabilities too" is supposed to make me feel better, given that Debian is an upstream of Ubuntu and so presumably those are ALSO unpatched in Ubuntu.

Debian is an upstream of Ubuntu only in the development release. Ubuntu stable releases are effectively branches (like the stable releases of every other distro).

Stable release maintenance of Debian and Ubuntu are thus independent in principle.

In practice patches for one are likely to be similar to what is needed on the other, issues affecting one are likely to affect the other, there are Debian developers who are also Ubuntu developers, Canonical employees who are also Debian developers, everyone is working towards a common goal of stable maintenance, and so forth, so there is quite a bit of communication and cross-pollination between the two. For example: I'm a Canonical employee and Debian maintainer; today I've spent quite a bit of time working on a security fix for a package I maintain in Debian that I'm effectively being paid to do by Canonical.

> If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora.

That seems like an unfair statement. Debian is a stable distro and I'd say has a pretty good track record of doing what it does. It seems disingenuous to suggest they're patching willy nilly.

I did not mean to belittle the efforts of package maintainers, most of which are people who don't get paid for it and do it out of their own volition (which I applaud!). They definitely put hours upon hours into improving the software that is shipped in Debian (or any other community distro for that matter). But you cannot argue that the efforts of a single maintainer compare to the effort of a dedicated engineering team, QA team, and a release engineering team of an enterprise company (Ubuntu, Suse, Red Hat), whose only job is to assure that every single bug is patched correctly.

Well of course, but debian isn't developed by a single maintainer, there's about 260 active maintainers and I believe well over 1000 contributors per year.

Either way, I don't think we should compare either on anything other than what they produce. You're free to think Ubuntu providers a better distro but please base it on something that isn't meta such as number of paid employees, because that does a disservice to those who give up their free time.

Distros like Manjaro have been on the receiving end of criticism regarding security updates, but how worse is it really compared to the more mainstream distros? I, as a layman, see no difference.

Didn't Manjaro suggest rolling your system date back because their certificate were out of date?

Sometimes it's not what went wrong, it's your approach to fixing it.

Well, no excuse for something like that. That's bad. I'm wondering generally though, after it reached some maturity (let's say 2016+ Manjaro), what's the difference in security of that distro compared to something like Debian? Is a distro like Arch more secure than any other? And do you need to be a Linux guru to be "safe" as a desktop user? Or does it really not matter that much at all to the casual user? Again, I'm a layman, genuinely interested in this topic. As you might have inferred, I've recently switched from Debian to Manjaro, and Debian was my first "home" Linux.

I think it's about what tools you use day to day. If, for example, you have SSH installed on your machine but don't have sshd enabled, then you could care less how outdated it is. Nobody is exploiting you through it if it's not running. If all you use your workstation for is browsing and text editing, then it's safe to assume you want those two applications to be as secure as possible. You can then look at, for example, what browser version the distro of your choice ships and judge it from that. Firefox, as an example, releases quite often and a distro that doesn't keep up with those updates gets a minus point from me. This is my personal view at things and may not sit with everyone.

Maybe Wireshark isn't the best example, since it's a tool one tends to use to identify potentially malicious traffic in the first place.

Exactly! So why would you ever consider this to be a safe application, with or without the vulnerabilities? Wireshark should be used in a closed environment (VM) as should all tools that handle potentially malicious data.