Except this isn’t true at all.
https://security-tracker.debian.org/tracker/CVE-2024-6387
Regresshion impacted bookworm and trixie both. Buster was too old.
With the downside of me doing an apt update and seeing that openssh-server was on 1:9.2p1-2+deb12u3 and I had no idea at a glance if this included the fix or not (qualys’s page states version 8.5p1-9.8p1 were vulnerable).
If you are running debian bookworm or trixie, you absolutely should update your openssh-server package.
Because the dev gets a huge number of bug reports for bugs that were resolved 5 versions ago.
They actually asked debian to stop shipping the screensaver, because they were getting tired of saying “this is already fixed, debian is just not going to ship the fix for another year”. Debian didn’t want to stop, so the dev added the nag screen, because it was the only way to stop the flood of bug reports for things that were already fixed.
my rant was not about your meme. But people actually use this argument seriously, and that frustrates me.
And I will admit that learning a new system has a time cost, but once you reach experience parity, the time cost per problem is less, and the number of problems is less. In that way, the “time spent” is an investment rather than wasted.
So A+ meme, it triggered me in all the ways it was supposed to.
Don’t have to spend time troubleshooting if you just never fix the BSOD and just kinda live with it. Point for windows
The thing I hate about the “value your time” argument is that windows is shit.
Let’s be generous for a minute and assume that windows and linux have the same amount of problems. Someone who is on windows for the past 30 years has 30 years of acquired knowledge and will probably know quickly how to solve it on windows, but not linux. Someone who is on linux for the past 30 years has 30 years of acquired knowledge and will probably know quickly how to solve it on linux, but not windows.
So the entire argument is just “but I have muscle memory tied to windows, and I already know how to solve those problems, but I dont know how to solve the linux ones, so they take me a lot of research and time to solve, therefore all linux problems always take a lot more time to solve”
On windows, I have to spend time fighting BSODs and finding out where to download software from that isn’t just bloated up with viruses, and how to run registry hacks to get rid of start menu ads and to stop microsoft from phoning home. None of those things i have to do on linux.
On linux, today my biggest issue was figuring out how to change the keybinding for taking a screenshot… And that was an easy issue, but it’s also not even possible on windows.
So I guess different types of problems. My “wasted” time is customizing my OS/environment so it works the way I want it to, not trying to fight back any ounce of control.
IMO it doesn’t matter. People don’t read news on updates. Should they? Yes. Do they? No. Should they have to? Also no.
Linus’s point is to never blame the end user for something the kernel changed. If you want software to have widespread adoption, adding homework to simple updates isn’t how you do it. People don’t want a hobby or something to babysit, they want an operating system. Debian will go out of their way to make in-release updates go as smooth as possible, but are willing to through out entire parts of functioning packages between releases.
But this isn’t even about breaking things for the end user. This will create excessive amounts of noise on the upstream repo. People will say “Hey! My keepassxc broke!” and they report it to keepassxc, and not to Debian. To which keepassxc just has to constantly reply “no, debian changed this on you, this is not a bug.” If Debian had to deal with the fall out of their own decisions, I would say “yeah, im not sure if i agree with the decision, but oh well”… But they are increasing the workload for other teams.
It is already happening. The debian dev’s stance is “This will be painful for a year.” But it will be painful for keepassxc, NOT debian. The keepassxc devs asked them to not do this. Debian’s response might as well be “Im inflicting this pain on you, even though you’ve asked me not to. But on the plus side, it won’t hurt me at all and it will only last a year for you.” If they really have that much disdain for the project, they should just stop packaging it altogether.
So yeah, debian has the legal right to do whatever they want because keepassxc is open source. but “just because I can, and you cant legally stop me, and its extra work for you, not me” is kind of a jerk move. This is what drives FOSS contributors to get burnt out and abandon otherwise good projects.
It’ll also break all your keepassxc plugins soon. Because debian version to version compatibility is not a priority. They also don’t care if them breaking something triggers a ton of upstream bug reports, because it will only “be painful for a year”
Linus for the kernel has a strict “don’t break userspace” policy, and Debian has a “break things whenever you want, and just blame the user for not reading the news file” policy.
too lazy to type this obvious thing in?
This has been the thing for me. I get really bored and lose focus when doing all the obvious repetitive stuff. And the obvious stuff is the stuff I find copilot does best. For anything that requires thought I’m engaged. Those are the fun parts of the job. It lets me do more of the fun part.
The one major downside that I’ve found is that sometimes I just want to tab complete a long variable/function name, and because of copilot i dont have “old style” tab completion anymore. (I could definitely still handle this myself, but i haven’t)
edit: this all to say that I don’t use copilot to write code that I don’t know how to write, I use copilot to write code that I’ve written 1000 times before and don’t want to write again. Copilot does a good job of looking through all the open files for context to help make sure the suggestions actually fit into the codebase’s pre-existing style.
I use wayland, but be warned that there are downsides.
X11 is 40 years old. Which means that even though it has 40 years of bad decisions baked into it, it also has 40 years of features and tooling built around it.
And in some cases, things are purposefully broken in the name of security as mentioned above. Writing a keylogger on X11? Easy. Every app can watch the keyboard even when they aren’t in focus. So if I type my password into firefox, Discord can listen. Hope you don’t have any malicious apps just patiently listening to all your keystrokes.
Getting rid of input listening sounds great! … Except for the concept of global keybinds. Have a Push to talk button in discord that you need it to be able to listen to while youre playing a game? Sorry, the game is in focus, so discord can’t see ANY of your input. Including the push to talk button. Different wayland servers have different ways of handling this with their portals. Some don’t have it at all. And the ones that do don’t always have great solutions.
One major issue that has been in wayland debate hell… how do multi-window apps communicate with each other. For example GIMP. The editor window is a separate window from the toolkit which is a separate from the layer view. GIMP on X11 knows where all of its windows are because it can see everything. if you wanted GIMP to save all the window positions, it could. GIMP on Wayland has no idea where each window is relative to each other. Each window knows its own size and shape. And thats it. It doesnt know where on the screen it is. Which means it doesnt know where it’s other sub windows are relative to itself. Which means GIMP on Wayland can’t really save the window positions for next run. Wayland is working on a protocol for handling this, but its been caught up in debate hell last I saw. This is a prime example of a thing X11 had. And Wayland will someday have, but the 40 year headstart and disregard for security gives X11 a huge headstart.
Most of these problems have workarounds and solutions, but you might find yourself in a situation where you do in fact need to implement a workaround instead of having everything Just Work.
“Better” means different things to different people. Architecture and security and technologically? Wayland is better. Just Works and its what your apps were probably built to run on so less weird edge case issues? X11 is still better just due to inertia. (And again, I use Wayland, I’m willing to deal with the workarounds, but you do you).
I didn’t realize that. I use a .xyz for a lot of my personal stuff and didn’t realize this. I wanted basically .website … i didnt want .com or .org or anything with tld that meant something, so xyz felt nice. Also, the domain I wanted with any popular tld was insanely expensive and i got my xyz for cheap when it was brand new (not for 1 dollar though).
Maybe I need to look into new domains, but I probably will just stick with it since its primarily for personal use anyway.
Caveat: This is all written assuming the message is being written on a computer with a real keyboard. But if we’re assuming this is written on a phone, then my analysis doesn’t apply, but then again, writing a java program to execute in your messaging app is also a terrible idea. Which means we’re suspending disbelief, so I choose to believe that a computer keyboard and shortcuts are available.
Type the phrase once. Select all. copy, paste, paste (the first paste replaces what you already have highlighted, the second paste adds a second copy). Now you have 2. Control + A, Control + C, Control + V… Now you have 4.
It will take you only 7 cycles of this get 128*, you only need to copy/paste it one by one if you want to send each message separately. and even then, it’s would purely be copy the original, then paste, send, paste, send, paste send, paste, send.
Assuming you can hold down control and just hit ACVV 7 times, that’s 28 keystrokes. I’d bet I can get that done in 5 seconds or less (i tried it, it’s less than that), so now I only save 5 seconds. Which means I only get 25 seconds to write the script. Which he chose to write in java for some reason?
[print("I'm sorry") for x in range(0, 100)] is actually a script I could write in less than 25 seconds.
*And I disagree with the “reason 4” given. She didn’t say “exactly 100 times” she said “100 times before I forgive you” and to me, “before” implies = and not ==. So if you drop it in 128 times, that exceeds the criteria. No one has ever rescinded forgiveness for receiving extra apologies.
The point of the meme is “Debian users are so proud of not having frequent updates… but when they do update, they have a huge backlog of things to update” … so yes, the fact that it’s not apples to oranges, and yet Debian users act superior is kinda the point.
And I use arch on my desktops but debian on my servers. I understand the difference. and yes, 20+ config changes is a bit of an exaggeration. I more frequently have to do minor tweaks to fix things on arch, but I also don’t need to set aside time to do arch updates “just in case” … because I have had debian upgrades cause weird side effects that wound up taking up my whole day.
The fact that i can go 2 years between those weird update days means I will still use it for my server, because “just security upgrades” is good enough for a server (even though I would love to have an updated tmux and neovim, so i could share config files, but oh well, i can go without config files on my server, debian DOESNT manage user config files, definitely not any more than arch does.). I don’t “not get it” or something. I understand why people use debian, I use it in certain contexts, but it does also have it’s own set of drawbacks.
“update” here referring to the version update, eg bullseye to bookworm. hence the title sources.lists because version updates disable all ppas.
Also, because of the “stable” nature of things, instead of a slow trickle of updates, when you finally update the version, you get a flood of updates. Changing from $PACKAGE version 5 to $PACKAGE version 9 very likely has breaking config changes… Avoiding breaking config changes is the entire purpose of a “stable” distro right?
If on arch, you get those breaking changes once a month, a two year release cycle means that the update to the next debian will have 24 breaking changes involved that you get to deal with all at the same time, while accounting for the fact that your /etc/apt/sources.list.d are all disabled.
This was fixed ages ago, but you are using Debian because it is “stable” and thus software from ages ago and don’t have the fix.
Most people use stable to refer to something that doesn’t crash or cause issues. Something that you might call “rock solid” which implies it’s not going to fall over. Something to put on your server because you’ll get great uptime without issues.
Debian is one of the few places where stable might crash more than unstable, because known bugs in Debian don’t get backported unless they cause security issues.
I use Debian on my servers because “some testing” is nice and the only thing I run on my servers is docker. And ironically, I have to use a PPA for docker.
So for me, it’s a stable enough base OS, but it “too stable” for anything that actually runs on the servers.
Debian is not all about “stability” in the sense of “doesn’t crash”. Debian is all about consistency. The platform doesn’t change. That means if there is a bug that crashes the system for you… it’s going to consistently be there.
For me, it was when stable was on kernel 3.16, and 3.18 was in testing, but the latest kernel was 3.19. And this was an era where AMD’s drivers not fully OpenGL compliant yet. Which meant games would crash. And knowing “this game will always crash until 3 years from now when we finally get a newer kernel” was enough to chase me off.
debian’s neovim package is 0.7.2. Sid is 0.7.2. Experimental is 0.9.5… If there are any bugfixes between 0.7.2 and 0.9.5 that are critical for your workflow… too bad. If its not a “security” release, its not getting updated. You can live with knowing the bug.
“Never change anything, stick to known good versions” only works if you know 100% that the “known good version” is actually bug free. No code is bug free, so inevitably the locked down versions in Debian will have still some flaws (and debian doesn’t backport bugfixes, they only backport SECURITY fixes). For most use cases, the flaws will be minor enough to not matter. But inevitably, if a flaw exists, it affects SOMEONE.
If you actually want to do any sort of complicated computing, debian is not a great choice. if you want a unchanging base so you can run a web browser and processor, I’m sure it’s great.
(although my ~15 years as a windows sysadmin probably bias my opinion)
So basically: it’s not any harder in linux, but you have more than a decade of muscle memory in windows, so it’s harder for you.
That’s like saying “Japanese is a less efficient language than English, all of the words are different, and when I want to say a word, I have to learn it first, but in English I just know the words! English is so much better! (My 30 years speaking english probably bias my opinion)”
Things are certainly different, but its hard to compare which is “harder” for the advanced use cases.
There’s no shame in having long term experience with one platform and having that shape your expectation about how a solution should look.
A developer shouldn’t be able to do this thing either. So unless they were the person in charge of securing things, it’s not their fault that it was even possible to do. Setup processes with oversight.
If a junior dev somehow finds a way to drop our prod database, that is on me, not them. Why did I give them access to do that?
Should they? Yes. They should also be searching for previous bug reports. I’m sure a lot of people do. But if you have enough users, even if 1% of people don’t use good reporting behaviors, you wind up with a lot of duplicate or bad reports.
There are plenty of blog posts out there that basically can be summarized as talking about how grueling open source work can be because users are often aggressive in their demands.
But this is a prime example of debian “stable” doesn’t mean “no crashes” but instead it means “unchanging, which means any bugs and crashes will remain for the whole release”