Hacker News Reader

Comment by InsidiousWombat | Hacker News Reader

Plain Debian was always best option; even RHEL dropped the ball on this CVE and that's distro people pay for support

Not always. Notably, if you have compliance requirements like needing FIPS encryption (say because you have government customers), or that requires you to use a commercial vendor, debian won't work. And if you need more up to date system packages, or a reliable release cadence, Ubuntu might be better.

On desktop, if you need proprietary drivers, Ubuntu is easier to set up.

But yes, if debian works for you, I wouldn't use Ubuntu.

Uh, yes it will. OpenSSL in Trixie is a version supported.

https://packages.debian.org/trixie/openssl-provider-fips

It's just the library, nothing special about the OS.

https://csrc.nist.gov/projects/cryptographic-module-validati...

As far as I know, compliance comes with an external module:

https://openssl-library.org/post/2025-03-11-fips-140-3/

This module seems to be in Debian:

# apt-cache search fips | grep open openssl-provider-fips - Secure Sockets Layer toolkit - cryptographic utility

# dpkg -L openssl-provider-fips /. /usr /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/ossl-modules /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so /usr/share /usr/share/doc /usr/share/doc/openssl-provider-fips /usr/share/doc/openssl-provider-fips/changelog.Debian.gz /usr/share/doc/openssl-provider-fips/changelog.gz /usr/share/doc/openssl-provider-fips/copyright

There seems to be the validation process, which supposedly must run on each machine it is used on.

openssl fipsinstall -out /tmp/configfile.cnf -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so 2>&1 | tee /tmp/result.txt

The above are from my notes, and a test run. But I don't see how Redhat is "special" here. If the module loads and cites compliance, you comply.

> OpenSSL in Trixie is a version supported.

It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module.

> It's just the library, nothing special about the OS.

If you need validation, then the kernel also need to be validated.

Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse.

I compile software every day. There's nothing difficult about it until cmake starts complaining, but I've got it back on track every time.

Companies who care about whether their FIPS implementation is validated or not would probably prefer buying from a company who sells it over relying on a guy at their company to get cmake back on track regularly. At that point, it's not just about the module, it's about custody, liability, etc.

Jeez laweez. Since when can lawyers make good technical decisions?

I saw a PIN terminal reboot a while ago and the openSSL version was ancient, pretty much historic at that point. But it has an unbroken seal on it, so it's safe, right?

The problem always boils down to money.

It isn't just compiling something that works. You need to compile it exactly as specified. And document the entire process so you can prove to an auditor that you did everything correctly. Oh, and there's a list of tested platforms, and if your platform isn't on there, which Debian probably isn't, you need to explain to the auditor why it's ok, and why it isn't reasonable for you to use one of the platforms it was tested on.

What you are paying for is not saving the time of a developer compiling something. It's reducing the friction when you go through an audit.

I wonder what the specifics of certification are. No certificate can ever prove a given binary works correctly. No one really understands how computers work, but here's a piece of paper that says Oracle Linux 11.0 is okay. It was expensive and it has a seal of approval on it, so that proves it.

What is FIPS encryption, why is FIPS unique to RHEL, and what has FIPS got to do with this CVE?

>What is FIPS encryption

presumably they mean meeting fips standards https://en.wikipedia.org/wiki/FIPS_140

>why is FIPS unique to RHEL

its not

>what has FIPS got to do with this CVE?

it doesnt. it is brought up in reply to the comment.

FIPS is a US government security standard: https://en.wikipedia.org/wiki/FIPS_140

It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification.

It's about using a certified cryptography implementation. Presumably RHEL has such a certification, while Debian has a compliant but uncertified implementation.

This isn't relevant to the CVE, but counters the claim that Debian is always a suitable choice of distribution.

I had to deal with FIPS once because the company I worked for shipped a custom Linux distribution with the product and we had to essentially shoe-horn in some Red Hat OpenSSL packages to get it to meet FIPS requirements. What's funny is that after the customer enabled FIPS, administration became much harder, and the encryption strength was strictly worse.

Anyway, needing FIPS is something of a niche requirement. Debian or Rocky are very sane choices as a default Linux distribution for general-purpose servers until you run up against special requirements.

> Anyway, needing FIPS is something of a niche requirement.

For sure. Most of the time, Debian is just fine. But sometimes, if you have special requirements, something else might be better.

I planned to install Debian in 2009 and in 2014 but the installer was too hard to use, the desktop in 2009 was ugly (maybe in 2014 too), I could not get a running system that I could use to work. Fast forward to Debian 10, same laptop from 2014, and I got a desktop identical to Ubuntu GNOME.

Red Hat is always slow in backporting patches to their Frankenkernel.

I don't want to run unstable, just to have recent software.

Debian for hosting anything, Fedora for development desktop.

That's been my rule for years at this point, I think I switched back to debian everywhere after the netplan changeover in ubuntu so somewhere around 17-18 (not against it in principle, just the way they did it in practice).

No real regrets either.

Reply on news.ycombinator.com