Hacker News Reader

Comment by Twirrim | Hacker News Reader

Ubuntu is... interesting.

Watch out for what packages you rely on, and what repository those packages come from. If they're in universe, expect your bug reports on Launchpad to go unanswered or unresolved. The only way to get fixes in them is to go upstream to Debian. But note that not every bug in a universe package is actually fixable or broken in a Debian world, because the bug might be down to interactions between a decision made by Canonical with packages in the main repository, and those for the universe package.

View on HN

Yes. For some reason people, even those running Ubuntu servers, are surprised to learn that universe has no guarantee to get updates for known vulnerabilities.

Ubuntu is currently divided into four components: main, restricted, universe and multiverse. All binary packages in main and restricted are supported by the Ubuntu Security team for the life of an Ubuntu release, while binary packages in universe and multiverse are supported by the Ubuntu community.

https://wiki.ubuntu.com/SecurityTeam/FAQ

If you care about security, disable universe and multiverse on servers, or use Debian Stable if you want a Debian-based distribution.

I think ubuntu has done a decent job with universe by and large. I find it in much better shape overall than epel. A good way to judge the health of these auxiliary repos is to look at the age of chromium. Ubuntu is generally good with patching at least security issues in universe. epel is still running behind by a month or two despite the security disclosures. So RH ought to take a page from Canonical's book when it comes to epel and make it a more official thing than the entirely community driven thing it is right now.

I don't mind RH being slower as I take it that's what makes RH what it is. Old packages but most stable.

It's not about RH packages directly. They are fine. As it is with universe on ubuntu, you quite likely need epel on rhel for doing quite a lot of basic stuff. If you are able to get by with just the proper supported packages in each distro, this doesn't affect you. And that's where the two diverge. universe is in better shape since it is semi-official, v/s epel which is completely unofficial/community-based.

Actually, since EPEL is often backports from Fedora, many people elect to keep them up to date with what's shipped in Fedora, so it tends to do better than other counterparts.

The closest counterpart is SUSE's PackageHub, which is often seeded by stuff going into openSUSE Leap that isn't part of SLE itself.

Just saw your other comment about Fedora. Thanks for Fedora and EPEL. I was just pointing out that EPEL would benefit from some recognition as a semi-official but ultimately unsupported repo from RH. Technically RH already has 'optional' channels which are already in that category, but EPEL should really be that. Some communication channel between RH and EPEL and QA so that stuff doesn't break on RHEL point releases and maybe some resources for security updates would go a long way in making RHEL more usable.

We'd all love that. It's funny, because Red Hat does regularly source content from EPEL to pull into RHEL for various products, which is where these issues come from.

I would love it if Red Hat were to give it proper recognition. I honestly don't know why they haven't yet...

Are you a RHEL customer? If so, telling your salespeople this would not hurt. Just sayin' :)

Reply on news.ycombinator.com