you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 5 days ago (4 children)

How does Debian do level and security updates? Are they generally a good pace but userland starts consistent?

  • source
  • hideshow 4 child comments
  • [–] 19 points 5 days ago (3 children)

    They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 5 days ago (1 child)

    Exceptions exist, for example rsync recently got a new upstream version to fix 33 CVEs: rsync.NEWS

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 5 days ago

    I also saw that recently. I'd like to highlight this bit from the news:

    This update contains behavior changes, all of which stems from the CVE fixes themselves, not exclusive to the version bump.

    So it looks like the package is still mostly kept stable despite the exception made.

  • source
  • parent
  • [–] 2 points 5 days ago

    it is rare but some feature updates do get to stable, most software that is important to up to date with security fixes have the concept of an LTS or somethinf akin to it, firefox has ESR for example, basically it is a version where the devs will continously backport security fixes to it but not the features

  • source
  • parent