The following security updates require Ubuntu Pro with 'esm-apps' enabled

Posted by DmC8pR2kZLzdCQZu3v@reddit | linux | View on Reddit | 6 comments

[-]

Patch86UK@reddit

For clarity: this isn't a roadblock being put on an existing support stream, it's a new support stream. Previously Ubuntu didn't provide security patches for "Universe" repo packages (instead relying on upstream patches to happen when they happen). The Ubuntu security team are now producing in-house security patches for these packages, but only where Pro has been opted into (which is free for personal use).

If you don't want to opt in to Pro you still have the same level of support you had before (and the same level of support that you have with 99% of other distros).

[-]

shroddy@reddit

I find it more concerning that Ubuntu just ignored vulnerabilities in these packages before Ubuntu pro was a thing. Is it the same on other distros or is it only the case for Ubuntu that they know about vulnerabilities but decide not to bother updating them?

[-]

Patch86UK@reddit

Is it the same on other distros or is it only the case for Ubuntu that they know about vulnerabilities but decide not to bother updating them?

This is the case for all distros, to various degrees, with the exception of a few like RHEL which already offered a premium paid service. Most distros don't maintain their own "Security Team" at all, and rely on individual package maintainers and upstream developers for all software patches.

It's also the equivalent of, in Windows land, Microsoft generally not getting involved in security patches for random third party software that you've installed.

[-]

kevmuhuri@reddit

As described here, Ubuntu uses Debian Import Freeze and doesn't sync with Debian Unstable when newer versions of packages are released. So the Pro version is backporting security updates that might be found in newer package versions to the old package versions that are frozen in lts or non-lts Ubuntu. Right?

Backporting security updates to old package versions makes sense for enterprise as described here. But for average desktop users, updating via PPAs or compile the latest versions from source might be better.

[-]

tracyv69@reddit

that is what used to set Linux apart from Microsoft.