LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   *BSD (https://www.linuxquestions.org/questions/%2Absd-17/)
-   -   Long term support considered harmful (https://www.linuxquestions.org/questions/%2Absd-17/long-term-support-considered-harmful-4175532228/)

JWJones 01-27-2015 02:16 PM

Long term support considered harmful
 
http://www.tedunangst.com/flak/post/...idered-harmful

Quote:

After the bug was fixed, it took some time for the new glibc release to trickle down into various Linux distros. But what takes even longer is for all the already shipped and supported versions to slowly cycle out of their maintenance window. Hence, the big rush to patch today.

Randicus Draco Albus 01-27-2015 06:33 PM

I would say both sides of that debate have good arguments. A short support cycle forces people to upgrade sooner, causing bugs to disappear sooner, whereas a long release cycle removes the need to upgrade often. Those in the latter camp could argue that frequent upgrades are inconvenient for large networks. Possibly servers as well, although that would be mitigated by the safer upgrades. Myself, I prefer long periods between upgrades, but I found the last OpenBSD upgrade to be easy. If every upgrade is as flawless as that one, I could quickly get used to frequent upgrades.

TobiSGD 01-27-2015 07:52 PM

As often, everything has two sides.
Yes, upgrading more often may wash out old bugs faster.
But it also increases the chance of being hit by new bugs.

I am somewhat irritated that OpenBSD has the same support cycle as Fedora (never realized that before, since I only had short testing runs with OpenBSD), yet we recommend OpenBSD for servers, while usually Fedora (and other distributions with short support cycles) is dismissed for that use case. Yes, I know that OpenBSD still is more secure and stable, due to the different focus of the development team, but how can we ever know with such a short release cycle (read:testing phase)?
Or am I missing something?

Anyways, following that logic, wouldn't a rolling release model fit best for OpenBSD?

hitest 01-27-2015 08:16 PM

Quote:

Originally Posted by TobiSGD (Post 5307540)
Yes, I know that OpenBSD still is more secure and stable, due to the different focus of the development team, but how can we ever know with such a short release cycle (read:testing phase)?
Or am I missing something?

There is a testing phase built in to the 6 month development period, that is, they're not developing, adding new features right up to the May 1st release date of OpenBSD 5.7. The team asks for bug reports and a number of users run OpenBSD -current and help with bug fixing.
I've been an OpenBSD user since 5.0 and it is my favourite BSD.

Randicus Draco Albus 01-28-2015 12:50 AM

Quote:

Originally Posted by TobiSGD (Post 5307540)
I am somewhat irritated that OpenBSD has the same support cycle as Fedora (never realized that before, since I only had short testing runs with OpenBSD), yet we recommend OpenBSD for servers, while usually Fedora (and other distributions with short support cycles) is dismissed for that use case. ... Or am I missing something?

This quote was posted on DaemonForums today. It shows the difference between the rapid release model used by some Linux distributions and the one used by OpenBSD.
Quote:

5.7 lock is approaching, so in order to help focus efforts in the right areas, it would be helpful if people could update to recent base and package snapshots and make sure things are working as expected.

Reports of any problems seen in updates from 5.6 release to -current would be particularly useful at this point.

Developers:

- No new ports.

- Slow right down on routine updates, this is not a time to rush to get things in before release. Not moving to strict approvals yet, but use your brains or we'll have to :-)

Submitters:

- Please don't flood us with things that we'll have to ignore until we're done with release.
If Fedora operates anything like Ubuntu, new software will be added before it is ready in order to meet the release deadline. OpenBSD only adds new software if it can be made ready before release. If it is not yet ready, the software must wait for a later release. I do not know how similar Fedora's attitude toward adding new software is to Ubuntu's, but Fedora is known for having occasional bugs.

TobiSGD 01-28-2015 04:51 AM

So OpenBSD's release model works like Debian's, with some type of freeze phase, only much shorter. That makes sense, thanks for clarifying.

cynwulf 01-28-2015 10:54 AM

Quote:

Originally Posted by TobiSGD (Post 5307540)
I am somewhat irritated that OpenBSD has the same support cycle as Fedora (never realized that before, since I only had short testing runs with OpenBSD), yet we recommend OpenBSD for servers, while usually Fedora (and other distributions with short support cycles) is dismissed for that use case.

OpenBSD is an operating system. As such OpenBSD should be compared (roughly) with the Linux kernel rather than a Linux distribution such as fedora/Red Hat who do not develop their own kernel and base system - if it should be compared at all.

In general terms, OpenBSD (as with other BSD forks) is much smaller than a given Linux distribution and almost everything in the base system is developed by OpenBSD developers, or if not, extensively audited and/or specially built to conform (for example X.org (xenocara) which has proper privilege separation as standard among other things (yes OpenBSD actually has X.org as a 3rd party component of it's base system unlike other *BSDs where it's a port).
Quote:

Originally Posted by TobiSGD (Post 5307540)
Yes, I know that OpenBSD still is more secure and stable, due to the different focus of the development team, but how can we ever know with such a short release cycle (read:testing phase)?

They are their own upstream, as such their testing process is probably much more streamlined and do not include the same 3rd party software as a Linux distribution like fedora or Debian (who pretty much throw anything and everything into the mix) and happen to have a well proven track record. They also manage to develop software such as OpenSSH, OpenNTPD and LibreSSL and more.

Quote:

Originally Posted by TobiSGD (Post 5307540)
Or am I missing something?

Anyways, following that logic, wouldn't a rolling release model fit best for OpenBSD?

The 'best' OpenBSD branch is OpenBSD -current. You could consider this "rolling", but in the Linux world, that term usually refers to some Linux distribution which constantly pushes out 'bleeding edge software' ready or not. OpenBSD -current is anything but that.

http://www.openbsd.org/faq/faq5.html#Flavors

Quote:

It is worth pointing out that the name "-stable" is not intended to imply that -current is unreliable or less robust in production. Rather, the APIs (how the programs talk to the OS) and features of -current are changing and evolving, whereas the operation and APIs of -stable are the same as the release it is based on, so you shouldn't have to relearn features of your system or change any configuration files, or have any problem adding additional applications to your system.

In fact, as our hope is to continually improve OpenBSD, the goal is that -current should be more reliable, more secure, and of course, have greater features than -stable. Put bluntly, the "best" version of OpenBSD is -current.
The important difference here between OpenBSD and your example fedora, is that, as is the case with most *BSD operating systems, the base system is OpenBSD, the ports tree is not - it's 3rd party software. In most *BSD OSs ports install to the /usr/local target, rather than /

This means that ports can be built and installed as a non root user.

It's best to read the official explanation: http://www.openbsd.org/faq/faq15.html#Intro

A given OpenBSD -release provides pre-built ports known as 'packages', to update these at all, you have three options:

1) Wait 6 months until the next OpenBSD release and ports rebuild.
2) Follow the -stable branch and build from source via the ports tree.
3) Sort it out yourself.

If you go to the openbsd-misc mailing list asking questions about out of date ports, you can expect to get ignored.

TobiSGD 01-28-2015 12:06 PM

Thanks for the further clarification, I think I understand it now.

GazL 01-30-2015 07:47 AM

Quote:

Originally Posted by cynwulf (Post 5307824)
A given OpenBSD -release provides pre-built ports known as 'packages', to update these at all, you have three options:

You missed one.

4) Use pre-built binary packages from a 3rd party such as M:Tier (https://stable.mtier.org/)


Also, last time I looked into this, while there is a -stable branch for base, there was no maintained -stable branch of 'ports'.

cynwulf 01-30-2015 04:08 PM

Quote:

Originally Posted by GazL (Post 5308873)
You missed one.

4) Use pre-built binary packages from a 3rd party such as M:Tier (https://stable.mtier.org/)

I didn't miss it, I didn't cover it, as it's not part of the official release/ports tree.

Quote:

Originally Posted by GazL (Post 5308873)
Also, last time I looked into this, while there is a -stable branch for base, there was no maintained -stable branch of 'ports'.

Just as there are ports for -release and -current, there are ports for the patch branch (-stable). I happen to use them.

hitest 01-30-2015 04:34 PM

Quote:

Originally Posted by cynwulf (Post 5309161)
Just as there are ports for -release and -current, there are ports for the patch branch (-stable). I happen to use them.

I tend to use binary packages. I will occasionally use ports from the -release branch. At the moment I don't have ports installed. As my openbsd box is now a faster machine I may use ports on 5.7.

cynwulf 01-30-2015 04:41 PM

It's fine to use binary packages and stick to -release + errata patches. In fact I might revert to that when 5.7 is released as these days I'm short of time to rebuild the base system and especially ports when something gets updated.

hitest 01-30-2015 06:21 PM

Quote:

Originally Posted by cynwulf (Post 5309175)
It's fine to use binary packages and stick to -release + errata patches. In fact I might revert to that when 5.7 is released as these days I'm short of time to rebuild the base system and especially ports when something gets updated.

Thanks for the reply. I am quite comfortable now with patching -release with errata. If it works, why mess with success? OpenBSD 5.7 is shaping up to be a stellar release. :)

GazL 01-31-2015 05:11 AM

Quote:

Originally Posted by cynwulf (Post 5309161)
Just as there are ports for -release and -current, there are ports for the patch branch (-stable). I happen to use them.

Interesting, I'm certain that when I looked into this a few years back there was no ongoing maintenance of '-stable' ports due to developer resourcing issues and the consensus was that if you needed updates between releases you ran current. Maybe things have gotten better now though. I see the FAQ says that -stable ports are supported for the latest release only, so that's still 6 months shorter than the base, so clearly resourcing is still something of an issue but its something.

veerain 01-31-2015 09:10 AM

Long term support is good.

But when we see news that security bugs were undetected for long times, there is hardly any reason to panic for bugs.

Just keep updating to reduce the chance of being hacked.

And openBSD is good for sure.


All times are GMT -5. The time now is 03:55 PM.