Language Selection

English French German Italian Portuguese Spanish

Debian struggling with security

Filed under
Security

Debian is facing difficulties getting timely security updates to users of its Linux distribution due to lack of manpower and software problems.

The issues recently surfaced when Debian released the latest version of its Linux distribution early in June, according to Martin Schulze, a member of the organisation's security team.

That release, Schulze wrote on his blog, caused configuration problems on the server which was responsible for distributing security updates -- and it hasn't been functioning properly since. "Several security updates aren't built on all architectures as they should be," the developer wrote only yesterday. "Currently, it's totally unreliable."

Lack of manpower also appears to be adding to Debian's security woes. Michael Stone, another member of Debian's security team, expressed his frustration to the organisation's security e-mail mailing list in mid-June, saying there was no effective tracking of security problems.

The problems have seen Debian fall behind competitors like Red Hat in releasing updates to widely-used programs. For example, although spam-filtering package SpamAssassin was updated by its creator to fix a remote denial-of-service vulnerability on 6 June, Debian provided the update on 1 July, while Novell's SuSE got the fix a week earlier on 23 June, Gentoo Linux on the 21st and Red Hat's Fedora still earlier on the 16th.

A similar situation occurred when the 'sudo' package needed an update in mid-June. In addition a number of security-related bugs are listed on Schulze's Web site as being unfixed, although the site also notes the data may be inaccurate as it is automatically generated.

Although Debian's infrastructure problems have not been as prominently discussed as the manpower issues on the project's mailing lists, giving some developers more authority is one idea that has been discussed as a way of speeding up the release of security updates.

As one developer put it: "The problem we're currently seeing isn't that the job is hard, but that only a very small number of people have the authority/ability to push the update out."

Another agreed, calling for the size of the security team to be increased from seven to 21.

Source.

More in Tux Machines

Alfresco Raises A Fresh $45M To Fuel Open-Source Enterprise Content Management

Alfresco, an open source, enterprise content management startup, is today announcing a new round of funding of $45 million — a Series D round that is more than twice as big as all of its previous rounds put together. The UK-based company competes against legacy services like Documentum (which was co-founded by one of Alfresco’s co-founders, John Newton) and Sharepoint to help large organisations manage their disparate document storage both in the cloud and on-premises, and also offer versioning control and other compliance requirements across mobile, PC and other devices. Alfresco will use the new funding to step its business up a gear, with new sales and marketing efforts, and moves into more cloud-based services that could see it competing more directly also against the likes of Dropbox, Box and Huddle. Read more

HandyLinux 1.6.1 Is a Linux Distro with a Windows Vibe

HandyLinux is a newer operating system and its developers have tried to provide a clear and familiar desktop interface. It might feel like it has a Windows 8 vibe, which is probably an effect of the theme used, but the OS is actually quite interesting. One of the most interesting aspects of the distribution is the menu launcher, which is quite odd. It opens a new window with all the applications and the user has to choose from there on. It's definitely something different from the norm. Read more

New Human Interface Guidelines for GNOME and GTK+

I’ve recently been hard at work on a new and updated version of the GNOME Human Interface Guidelines, and am pleased to announce that this will be ready for the upcoming 3.14 release. Over recent years, application design has evolved a huge amount. The web and native applications have become increasingly similar, and new design patterns have become the norm. During that period, those of use in the GNOME Design Team have worked with developers to expand the range of GTK+’s capabilities, and the result is a much more modern toolkit. Read more

Intel's Latest Linux Graphics Code Competes Against OS X 10.9

Tests I carried out last month with a Haswell-based Apple MacBook Air showed Linux largely smashing OS X 10.9 with the latest open-source graphics driver code on Linux over Apple's OpenGL driver. Today I'm testing the latest OS X 10.9.4 state against the newest Linux kernel and Intel Mesa driver code on Ubuntu while this time using an older Sandy Bridge era Apple Mac Mini. Read more