Hello folks,

As we all know Debian Jessie Freezes on Nov 5, 2014. We do not get timely security updates for testing/jessie (alpha/beta).

Does anybody know whether we will get timely security updates (as we do get them on Wheezy) after Jessie is frozen?


Thank you for your time.

Please try this.

Thanks for the reply, buddy, but didn't find the answer to my question. Thanks for your time anyway.

Sorry, I'm not that familiar with the release cycles of Debian, I usually just subscribe to their stable release. Anyway, you can get yourself familiar by subscribing to their mailing lists, where you can ask the concern yourself.

It would be really nice as well if you can share the answer once you have it.

Sure I will post the answer here when I find it. Have good day!

This is a rather difficult question in that the poor security package upgrades are poor compared to what?

Stable? Yes it is not as good.

Sid? Depends on the package. The package maintainer does the security work on their packages. Some will be better at this than others as far as timing goes.

The security team handles the security upgrades for testing. Obviously their top priority is going to be Stable and Old Stable. Then testing will get its upgrades.

I run Sid and testing on 2 installs sharing a common /home partition. I find that this dev cycle (Jessie) on my hardware that Sid runs a bit better so I am pretty much using Sid. In the Wheezy-testing cycle Wheezy, for most of the time, ran better than Sid. This is on my hardware and yours may be very different.

Ubuntu bases their LTS versions on testing. They base their other releases on Sid.

Until the Debian testing version on which the Ubuntu LTS release is based, like the current 14.04 LTS, they are pretty much dependent on Debian testing security releases. They seem to think this is fine.

The same goes with their "regular" releases. Think of all the versions of Ubuntu that are still supported and are still based on the Sid repo. This seems fine to them.

We got extremely good security support, and continue to, for the bash vulnerablility in all supported versions of Debian. That was pretty much an emergency responce. Most security upgrades are possible exploits that folks spot and they are patched long before they become a problem.

All your base distros and the kernel folks are watching for such problems. They get patches out pretty fast and share information constantly on potential and current security problems.

When we choose to use an unstable version of any distro we are signing on for cutting edge packages. These packages are going to have bugs and that should be our main worry. While there are a lot of us using unstable versions it is small compared to those using stable versions.

Therefore there is sort of a security lag for sure but also a lag on the part of potential attackers. No one would use an unstable version for critical information.

I have hardened versions of Squeeze and Wheezy on here too. If I need security for something I use one of them.

Here are a couple of links that may help you out;
https://wiki.debian.org/DebianTesting

That one discusses security in testing.

https://www.debian.org/releases/testing/

That one may also be of interest for general information.]

As for security when we go into freeze. I don't think that there is any change in the policies or priorities of the security team for that period. That said; the security should be some what easier to handle as the packages are supposedly at the final version or very close to it. All that is supposed to be going on is bug fixes. I would think this would make the security a bit better in testing but that is only what my opinion is.

Another thing you could compare security in Debian testing to would be the supported versions of Windows. They don't generally get security upgrades until the shit has hit the fan.

I think Linux does a bit better than that the vast majority of the time. I also think that the base distros do too with packages specific to them. The GNU folks do a fine job too. We as unstable version users have to realize that the number of folks looking at the code is a lot smaller for our packages than with packages used in Stable version.

I use testing and Sid because stable versions are boring.

Businesses, and probably people that are stable themselves, use stable versions because they are boring and really well watched over. We need to realize that the purpose of Debian testing is to build the next Stable. It is not supposed to be anything else. That to an extent includes secure. Obviously when Jessie is released it will be as secure as they can make it at that time but it can't be the first priority during the building process. The packages have to work first.

This is what the manual has to say about testing;
There is, I believe a link to that in the second link above. Most of the manuals are available as packages and if installed get upgraded when there are changes. If you like to have some reading material for times when you are off line that is some handy stuff.

Wow. another detailed response. I very much appreciate your time taken to share your knowledge and opinions. So we can expect Jessie/testing to be pretty secure and stable after Nov 5th. That's great!

One would imagine the security team has enough to do without spending a lot of effort to patch issues in packages that are going to be replaced by a new version shortly anyway.