Also, don’t worry, Debian has plenty of Toy Story characters left for many years of releases to come!
I only ever deploy and develop on Debian. Community run distros all the way. I had bad experiences with Redhat decades ago and do everything I can to avoid it or its siblings.
Debian has faults but it is often a taste thing. I like systems that give me upstream with minimal patches, like Arch. I moved to Arch on all desktops/laptops. The Debian devs repeatedly doing dumb shit with ssh patches was part of that. Arch is not unreliable but it is unstable. All that means is that software updates which aren’t backwards compatible sometimes require intervention . To be clear that is not a fault with Arch but it does make it much less suitable for long hassle free server deployments. Also Arch doesn’t have the Debian security announce list or maintain a stable production environment for years with backported security fixes and unnattended security updates.
Yeah, Debian is my favorite server software by a mile.
Yeah, Debian is my favorite
serversoftware by a mile.FTFY
Running my workstation and server on Debian stable. Debian always. Debian forever.
Amazing for a server. Both my servers run Debian and I have had no issues.
I run it on my daily driver laptop and I’m happy as a clam.
I did run it for a couple of year in the past. It was solid.
I run it with KDE for my daily driver & gaming and it is very boring and stable, which is what I want in my PC. Debian is 99% of the time supported.
I recommend it.
I’ve invested so much time and effort into CachyOS. I’ve been running it for over 2 years now. A switch would be very hard and unnecessary work for me since it works no issues for me. Otherwise, Debian would be on my machine.
Makes sense. I started with Ubuntu so Debian was a very natural move for me
I tried a few non-debian distro but always came back to it as it is the one I am most familiar with.
Not only does cachy work perfectly, Debian needs so much fiddling around to get latest software versions it’s a hindrance for a lot of stuff including gaming
Gaming and getting the latest kernel is a big one for me. My gpu and cpu are very new and they require the latest kernels. I’m sure there are ways to bring in the newest kernel to Debian, or just use Sid or testing, but why do that and what I have works no problem?
Due to slow update cadence it’s not a great idea for a server exposed to the internet
Their security updates are some of the best you could find, my friend. They are only “slow” on features. Debian doesn’t fuck around when it comes to security.
debian’s security updates are faster than Arch’s, Ubuntu’s and many more, you seem to not understand what the “stable” in “stable distro” means, please, this has nothing with security updates
If that server includes the security repository in its source files, I disagree. In fact, the use of the security repository in Debian has a history spanning more than 20 years.
Until some fucking php vulnerability grants root access
would arch have fixed this? no, what is your point?
Rolling releases better at updates, by definition, that’s my point. This can backfire, but also can save you sometimes.
we are talking abou specificly security updates, upstream for most projects that are important for security have a concept of LTS releases, e.g the kernel’s LTS, debian updates their stable packages rellying on upstream’s LTS, debian does sometimes switches to newer LTS releases even if it means breaking the no new feature general rule of thumb, e.g kernel LTS goes EOL, debian maintainers sometimes do try to backport fixes themselves but generally debian prefers to follow upstream’s LTS EOL where possible, generally updating to the oldest LTS not in EOL yet
debian has a specific team dedicated to security, updating packages, contacting and colaborating with upstream, reporting potential vulnerabilities e.g the xz backdoor first was reported to the ssh package maintaince team from which the importance and the nature of the issue was discovered and then reported to the debian security team which confirmwd the findings and made reports to other teams and tried contacting the old owner of xz since xz was effectively taken over by the malicious actor
If you are speaking about the latest php bug, debian stable and old stable were updated days ago, see https://security-tracker.debian.org/
it might be a failure to read on my part but this reads as unfixed on Debian but fixed on Arch
Edit: Oh, yeah ok, in the security repo it’s fixed, why is the vulnerable version distributed to stable though?
Technically, you are right. But this is due to the different release systems.
In Debian, security updates for the stable version are distributed via the security repository until a new point release is created. The last point release was two months ago.
However, in practice, on Debian Trixie, you get the fixed version by running a standard
apt update & apt upgrade.
Eh. They’re actually pretty on top of security patches for pretty much any internet-exposed server software.
The OpenSSL incident was a long time ago at this point.
Debian has become my favorite server OS. Some more specialized distros are great for specific use cases, but for 90% of my stuff, I just install Debian and chill.
Also Debian user remembering the last official release:
It’s interesting to me that Debian has this image of long time between releases. Mint for example is based on Ubuntu LTS which releases every 2 years, but I haven’t seen the same jokes about Mint.
Because Mint does release minor releases every 6 months
Debian does minor releases every so often, too. For example the current version of Trixie is on its 7th point release (12.7). Trixie was released last August.
Not only with intervals but also with quite old software. Sometimes software versions are so old that they are no longer compatible with the upstream version. Although, to be honest, I haven’t used Debian for so long that I can’t even name the applications that lagged behind like that.
In general, Debian is indeed incredibly stable, but if you need to install it on the latest laptop (for example, Intel Core Ultra X9), it will be a real hell.
UPD: except perhaps for using sid. But then you lose the only advantage - stability.
Honestly, in the age of Flatpak and containerization (as well as Debian often being well-supported by upstream projects for script or package-based install), I feel like the age of Debian packages isn’t that annoying anymore; anything important gets security patches, and it’s easier than ever to use 3rd party software without breaking your system. I will add that Debian seems to be much better these days at making sure either a reasonably up-to-date version ships with a release (and can be kept secure during a stable cycle) or not shipping it at all as to allow the user to install it themselves.
I remember back in just 2021 when it took months after Firefox ESR 78 went EOL for them to update Bullseye to 91; recently, it only took them a few days after 140’s EOL to switch to 153 (and 91-115 and 115-140 happened without much note either), which isn’t perfect, but much better than it was.
If you need to install it on a new laptop, backports often has you covered. I ran a backports kernel for about a year on Debian Bookworm to get my laptop’s Wi-Fi modem working; I was able to quit using the backports kernel once Trixie came out.
If you are using only Docker, you don’t need a Linux distribution at all. Just install alpine slim, busybox, or any Kubernetes worker node build.
Flatpak, much like snap, appimage, and other programs trying to shove old, hole-ridden libraries down my throat under the pretext that “the build is too complex,” is not the kind of software I would welcome on my PC. I’d rather build the application by hand.
- Alpine is still a Linux distro, just a lighter one. Also, busybox is a set of standard utilities as an alternative to coreutils; I have no idea how it’s particularly relevant here.
- The thing is, I’m not using only Docker. I also use native nginx as a reverse proxy, for which I like Debian’s defaults, as well as SyncThing, which are both well-maintained packages in Debian. Also I kind of prefer glibc distros. While glibc kind of sucks, so much stuff I like using prefers or requires it; for instance, last I saw, mDNS/Avahi resolution on BusyBox was kind of a pain in the rear.
- Most of what I use Flatpak for isn’t network-facing or opening unverified files anyway; the most important applications I do run the native Debian version. Honestly, truth be told, you are correct that I do often prefer native versions and will run the native Debian package if possible (and considering the current age of stable, a lot of them really aren’t that old; Inkscape is basically still the latest version, for instance, while Firefox is always kept to the latest ESR); at some point, though, I do find a Debian package that is too behind to do what I do (though rare, TBH), and despite some issues with Flatpak, at the end of the day, I need to just get a piece of software installed and get on with my day. In that case, I just do a Benjamin Sisko:
Honestly, in the age of Flatpak and containerization (as well as Debian often being well-supported by upstream projects for script or package-based install), I feel like the age of Debian packages isn’t that annoying anymore; anything important gets security patches, and it’s easier than ever to use 3rd party software without breaking your system.
i was pleasantly surprised in 2023 to learn that debian was still king in the server space and precisely because of this – i remember doubting trying debian on my personal hardware because of the age of the packages back around 2004.
I’ve found I don’t need bleeding edge most of the time. But if I do need something more up to date, there’s usually a package for Debian available. Wine is one example; I needed a more updated version than Debian stable ships, and WineHQ has it packaged for that. Installs easily and stays updated automatically.
Speak for yourself. I hate going back to old local Pis or servers I haven’t updated in years and realize that I’m 2+ releases behind and the one I’m on is already end-of-life.
Debian is honestly goated. Like I love me a nice boring stable distro that just keeps on chugging. I have done such crazy stuff to Debian and it just refuses to care. It’s like a nokia phone that got run over by a car and still works.
It’s the same for me for my Fedora install on my laptop, I installed version 38 when I got my laptop and now it’s on version 44, next week I’ll upgrade it to 45. It’s been rock solid, never had any issues with it.
Jumped on the Fedora ship with 36.
Updating to 43 or 44 broke my install so seized the occasion to try Silverblue instead of Workstation.
It’s even better although the immutable side has its limitation, so I’m happy to have another computer for these.
Fedora is based on debian?
Fedora was originally based on Red Hat. Later it became the main open distro in that family, and now Red Hat Enterprise is based on Fedora.
Nope, they’re completely separate distro families!
Debian is basically exactly what I want out of a daily driver. Everything is exactly where I expect it to be every time I go to use it, nothing ever breaks because of a regular update, and it’s not like I can’t just go get the flatpack if I absolutely need the most recent features on an app.
Debian is also perfectly capable of running more bleeding edge stuff if you really wanna do it. I built niri from source on it. Works great.
I always looked at their pace as a feature, not a bug.
Some features are just bloat.
I surfed a few distros before landing on Debian. It solved (almost) all the issues I had with Linux. Debian for life.
Debian the foundation of the modern world. Or at least we wish it was.
it is. at least in the digital world. good chance it’s running the server you are receiving my message through
I should install Debian to replace my current Ubuntu install at some point. Might move some services I run to a VM to reduce effort when reinstalling my OS. Then it’s just install steam and copy over my game backup folders. Plus with a VM I can easily move it to a proxmox mini PC if I ever get round to buying one.
I really need one of these shirts
DietPi, anyone? 🥹
How does Debian do level and security updates? Are they generally a good pace but userland starts consistent?
They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.
Exceptions exist, for example rsync recently got a new upstream version to fix 33 CVEs: rsync.NEWS
I also saw that recently. I’d like to highlight this bit from the news:
This update contains behavior changes, all of which stems from the CVE fixes themselves, not exclusive to the version bump.
So it looks like the package is still mostly kept stable despite the exception made.
it is rare but some feature updates do get to stable, most software that is important to up to date with security fixes have the concept of an LTS or somethinf akin to it, firefox has ESR for example, basically it is a version where the devs will continously backport security fixes to it but not the features
