The Linux Thread - The Autist's OS of Choice

  • 🏰 Deploying update to the Tatarus security page. If you encounter issues, post here.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
SchizoDaemon said:
This is total nonsense. There is a separate security archive that is fixed for the Debian stable distro as long as they are supported.

Backports are a separate thing where packages are taken from testing and backported to stable.
Click to expand...
it depends on the packages.

The Stable branch only pulls updates to the package version they use. So if Debian 13 is using package 12.x and the developer of package 12.x releases a security update in 12.1, Debian stable will have the update. But if the developer of the package does rolling release (like KDE) then there will be no 12.1 as the security updates are only in package 13.x, but installing version 13.x on Debian 13 would break too many packages. The backports branch will backport the exact fix into the version that Debian uses, but that is a manual process by volunteers and not an automatic system like the official updates to the stable package
 
acid_ra1n said:
I'm beginning to understand why security people don't like desktop Linux
Click to expand...
The security people that I normally have to deal with essentially just apply corporate policy and do a tick-box exercise. They don't like desktop Linux because they have no idea how it works.

In any event, all of this can be looked up in the Debian FAQ and googled in about 2 minutes. I don't understand how you or the community person that you were supposedly talking to are incapable of basic web searches.

I honestly feel like I am being gaslighted quite often on these threads.
Betonhaus said:
The backports branch will backport the exact fix into the version that Debian uses, but that is a manual process by volunteers and not an automatic system like the official updates to the stable package
Click to expand...
I think you are conflating "Debian Backports" with security fixes that are backported.

You are running Debian stable, because you prefer the Debian stable tree. It runs great, there is just one problem: the software is a little bit outdated compared to other distributions. This is where backports come in.

Backports are packages taken from the next Debian release (called "testing"), adjusted and recompiled for usage on Debian stable. Because the package is also present in the next Debian release, you can easily upgrade your stable+backports system once the next Debian release comes out. (In a few cases, usually for security updates, backports are also created from the Debian unstable distribution.)

Backports cannot be tested as extensively as Debian stable, and backports are provided on an as-is basis, with risk of incompatibilities with other components in Debian stable. Use with care!

It is therefore recommended to only select single backported packages that fit your needs, and not use all available backports.
Click to expand...
I don't recommend running backports for anything other than having a newer LTS kernel or stuff like a newer version of Pipewire.
 
Last edited:
SchizoDaemon said:
The security people that I normally have to deal with essentially just apply corporate policy and do a tick-box exercise. They don't like desktop Linux because they have no idea how it works.

All of this can be looked up in the Debian FAQ and googled in about 2 minutes. I don't understand how you or the community person that you were supposedly talking to are incapable of basic web searches.

I honestly feel like I am being gaslighted quite often on these threads.

I think you are conflating "Debian Backports" with security fixes that are backported

Click to expand...
Both of us read that page and q&a from the Debian team, that's why I was under the impression they did backport security fixes because it says it on that page but then the Debian team said otherwise, and he said that page is outdated
 
Hakase Shinonome said:
With my experience with Ubuntu, it really sucks massively on laptops.
Click to expand...
Speaking of.

This week Ubuntu decided it would boot up on my Surface Book 2 with the mainline kernal that 24.04.04 uses instead of the Surface kernal that I lovingly installed.

I only noticed because suddenly my touchscreen stopped working so digging around I saw the change. I managed to change it back in Grub but every time I boot up it reverts back to the official kernal.

And the touchscreen won't work because despite all of the files being where they're supposed to be and apparently having no cause not to function, that service isn't....well...functioning.

I'd blame Ubuntu but let's be honest, Microsoft made it as annoying as possible to run Linux on their machines.
 
acid_ra1n said:
Both of us read that page and q&a from the Debian team, that's why I was under the impression they did backport security fixes because it says it on that page but then the Debian team said otherwise, and he said that page is outdated
Click to expand...
Well you should have stated that more clearly. Who said so in the Debian team? Actually, I don't care. I now remember why I hate most people that are into Linux.
 
SchizoDaemon said:
Well you should have stated that more clearly. Who said so in the Debian team? Actually, I don't care. I now remember why I hate most people that are into Linux.
Click to expand...
Q: Is there security support for packages from backports.debian.org?

A: Unfortunately not. This is done on a best effort basis by the people who track the package, usually the ones who originally did upload the package into backports. When security related bugs are fixed in Debian unstable the backporter is permitted to upload the package from directly there instead of having to wait until the fix hits testing. You can see the open issues for stable-backports in the security tracker (though there may be false positives too, the version compare isn't perfect yet)

 
DavidS877 said:
Here's how security(not backports) are handled:
Click to expand...
That is what I quoted. Apparently someone, somewhere, said that isn't true.

We, of course, aren't given any information to verify this other than I spoke to a "community admin."
acid_ra1n said:
Q: Is there security support for packages from backports.debian.org?

A: Unfortunately not. This is done on a best effort basis by the people who track the package, usually the ones who originally did upload the package into backports. When security related bugs are fixed in Debian unstable the backporter is permitted to upload the package from directly there instead of having to wait until the fix hits testing. You can see the open issues for stable-backports in the security tracker (though there may be false positives too, the version compare isn't perfect yet)

Click to expand...
Backports is a separate repo. Which aren't packages that are part of the stable release.

They aren't the same as backported security fixes, which is what this FAQ is referring to.
 
Last edited:
SchizoDaemon said:
That is what I quoted. Apparently someone, somewhere, said that isn't true.

We, of course, aren't given any information to verify this other than I spoke to a "community admin."

Backports is a separate repo. Which aren't packages that are part of the stable release.

They aren't the same as backported security fixes, which is what the FAQ is referring to.
Click to expand...
Tbh I think the entire conversation I had was with some tard that was playing semantic word gamesz which is why I was confused because debian people would always defend their poor security to me by saying they do backport security fixes just they didn't specify which repo those backports were from
 
On the note of security, window managers wouldn't be objectively superior at the security level if the various desktop environments didn't rely on a low-level session management framework that happens to handle power management options. Even then, most software is going to require that low-level middleware which kneecaps a portion of the separation between your low level and surface-level graphical environments.
 
Trans Fat 41g said:
On the note of security, window managers wouldn't be objectively superior at the security level if the various desktop environments didn't rely on a low-level session management framework that happens to handle power management options. Even then, most software is going to require that low-level middleware which kneecaps a portion of the separation between your low level and surface-level graphical environments.
Click to expand...
I don't really understand wms as a threat model as a concept anyways
A DE comes with a suite of software which means more attack surface but a WM just offloads that to many different smaller programs, meaning you're mixing vendors and other potentially insecure programs
 
acid_ra1n said:
Tbh I think the entire conversation I had was with some tard that was playing semantic word gamesz which is why I was confused because debian people would always defend their poor security to me by saying they do backport security fixes just they didn't specify which repo those backports were from
Click to expand...
Backports is a separate thing, so you can pull in newer packages from testing into stable. I don't use it outside of the kernel, e.g., I am using Kernel 6.18 as it has many things that help with gaming performance on AMD.

Security fixes come through the security.debian.org.

BTW, This is how I manage getting newer stuff on Debian stable (if anyone cares)
  • Anything dev-related will be installed to ~/bin (this already in your path by default in Debian). /usr/local or /opte.g. NVM, dotnet, golang, rootless Docker etc.
  • Flatpak for big or proprietary stuff, e.g., Kdenlive, Discord, Slack.
  • Programs that have their own repo, e.g., Brave and VSCodium, have their own repo. Just use their repo.
  • Things like Neovim get built from source.
  • Backports for Kernel.
 
Last edited:
SchizoDaemon said:
Backports is a separate thing, so you can pull in newer packages to stable. I don't use it outside of the kernel and a few other select packages.

This is how I manage getting newer stuff on Debian stable (if anyone cases)
  • Anything dev-related will be installed to $HOME or /usr/local or /opte.g. NVM, dotnet, golang etc.
  • Flatpak for big or proprietary stuff, e.g., Kdenlive, Discord, Slack
  • Programs that have their own repo, e.g., Brave and VSCodium, have their own repo. Just use their repo.
  • Things like Neovim get built from source.
Click to expand...
I think the confusion stems from what the fuck do you call it when you fix a security issue in Debian stable by pushing security patches from a newer version of the program
I was told that's called backporting but apparently that's the wrong word or they just don't do that and I was completely misinformed
 
acid_ra1n said:
I don't really understand wms as a threat model as a concept anyways
Click to expand...

The KDE devs for instance overlooked a massive flaw with the global themes management UI where it would rm -rf critical directories and didn't really do anything about it until the 6 series. Imagine what problems exist with the gui for configuring bootup splash screens.
 
acid_ra1n said:
I think the confusion stems from what the fuck do you call it when you fix a security issue in Debian stable by pushing security patches from a newer version of the program
I was told that's called backporting but apparently that's the wrong word or they just don't do that and I was completely misinformed
Click to expand...
  • There is a repo called "Debian Backports" that takes software from stable and backports the entire package to work with stable.
  • There is a process of "backporting a security fix" where they take code from a newer version of a package that fixes a security issue and then take those changes and apply them to the older versions of the package.
 
Trans Fat 41g said:
The KDE devs for instance overlooked a massive flaw with the global themes management UI where it would rm -rf critical directories and didn't really do anything about it until the 6 series. Imagine what problems exist with the gui for configuring bootup splash screens.
Click to expand...
Ya I know on secureblue they highly recommend against using global themes and by default don't enable them
I still installed oxygen theme cause of course
But iirc the problem with kde's themes is they're insecure by design because they're glorified scripts and can run whatever the fuck is in the script with absolutely nobody vetting the code


There is a repo called "Debian Backports" that takes software from stable and backports the entire package to work with stable.
There is a process of "backporting a security fix" where they take code from a newer version of a package that fixes a security issue and then take those changes and apply them to the older versions of the package.

Ok that's what I thought it was but the looney troonies at the Debian braintrust sure as fuck didn't
 
SchizoDaemon said:
There is a process of "backporting a security fix" where they take code from a newer version of a package that fixes a security issue and then take those changes and apply them to the older versions of the package.
Click to expand...
Of course, not all security fixes need that, sometimes the vendor/author releases a dot or patch release that can give a minor version bump without breaking the concept of "stable". Which is why Debian(and RHEL) just call them security fixes.

Here's an example:
Code: 
trixie    150.0.7871.100-1~deb13u1
trixie (security)    150.0.7871.181-1~deb13u1
This fix was a dot release by upstream, so the "deb13u1" was not incremented but they tracked a newer upstream.
Code: 
trixie    4.98.2-1+deb13u3
trixie (security)    4.98.2-1+deb13u4
This was a backported patch indicated by the upstream version remaining the same and the debian version being updated.
 
Last edited:
Trans Fat 41g said:
The KDE devs for instance overlooked a massive flaw with the global themes management UI where it would rm -rf critical directories and didn't really do anything about it until the 6 series. Imagine what problems exist with the gui for configuring bootup splash screens.
Click to expand...
To be fair KDE is fundamentally dangerous. Its a rolling release meaning that any slower moving distros like Debian/Ubuntu will always be out of date, and it's so pervaseive in all the points it touches in the system

Cinnamon is a LOT more secure in comparison, it's more focused on stability and doesn't tunnel into all of the crevices of the system as much.
 
You must log in or register to reply here.
Back
Top Bottom