Language Selection

English French German Italian Portuguese Spanish

Debian struggling with security

Filed under
Security

Debian is facing difficulties getting timely security updates to users of its Linux distribution due to lack of manpower and software problems.

The issues recently surfaced when Debian released the latest version of its Linux distribution early in June, according to Martin Schulze, a member of the organisation's security team.

That release, Schulze wrote on his blog, caused configuration problems on the server which was responsible for distributing security updates -- and it hasn't been functioning properly since. "Several security updates aren't built on all architectures as they should be," the developer wrote only yesterday. "Currently, it's totally unreliable."

Lack of manpower also appears to be adding to Debian's security woes. Michael Stone, another member of Debian's security team, expressed his frustration to the organisation's security e-mail mailing list in mid-June, saying there was no effective tracking of security problems.

The problems have seen Debian fall behind competitors like Red Hat in releasing updates to widely-used programs. For example, although spam-filtering package SpamAssassin was updated by its creator to fix a remote denial-of-service vulnerability on 6 June, Debian provided the update on 1 July, while Novell's SuSE got the fix a week earlier on 23 June, Gentoo Linux on the 21st and Red Hat's Fedora still earlier on the 16th.

A similar situation occurred when the 'sudo' package needed an update in mid-June. In addition a number of security-related bugs are listed on Schulze's Web site as being unfixed, although the site also notes the data may be inaccurate as it is automatically generated.

Although Debian's infrastructure problems have not been as prominently discussed as the manpower issues on the project's mailing lists, giving some developers more authority is one idea that has been discussed as a way of speeding up the release of security updates.

As one developer put it: "The problem we're currently seeing isn't that the job is hard, but that only a very small number of people have the authority/ability to push the update out."

Another agreed, calling for the size of the security team to be increased from seven to 21.

Source.

More in Tux Machines

F2FS Feature Work For The Linux 4.11 Kernel

The Flash-Friendly File-System (F2FS) will see new features introduced with the Linux 4.11 kernel. F2FS for Linux 4.11 is making use of a separate thread for discards to avoid latency problems during checkpoints and fstrim, some prep work for open-channel SSD support, on-disk bitmaps are being introduced, and various other changes. Read more

Q4OS 1.8.3, Orion

New update of stable Q4OS 'Orion' desktop is available. Bunch of important packages updates and security patches has been delivered, as well as improvements of the native Q4OS update manager application. All the changes are available for existing Q4OS users via the automatic update process. Work on the next major version, Q4OS 2.3 'Scorpion' continues as the Debian Project also nears end of development cycle for the Debian GNU/Linux 9 'Strech' operating system, upon which Q4OS 2.3 will be based. The release date is preliminarily scheduled at about the turn of April and May 2017. Q4OS 'Scorpion' will be supported at least five years from the official release date. Read more

Games for GNU/Linux

today's howtos