News for hackers. Stuff that matters.

A comment on Yes, Ubuntu is withholding security patches for some software. Parent comment

Re:Yes, Ubuntu is withholding security patches for some soft... by isaacremuant on Tuesday November 14, 2023 @12:14AM (#38259437)
That's absolutely terrible and not clear at all.

I've been tempted to go back to Arch and I think this can be a good motivator.

[ Parent | on HN ]
Re:Yes, Ubuntu is withholding security patches for some soft... by svc0 on Tuesday November 14, 2023 @12:32AM (#38259515)
Just to be clear, on Arch ffmpeg is outdated (6.0 vs 6.1.) This means it has three security vulnerabilities.
[ Parent | on HN ]
Re:Yes, Ubuntu is withholding security patches for some soft... by panarky on Tuesday November 14, 2023 @01:57AM (#38259975)
Debian's ffmpeg is at 6.1, no subscription nonsense required.
[ Parent | on HN ]
Re:Yes, Ubuntu is withholding security patches for some soft... by viraptor on Tuesday November 14, 2023 @02:05AM (#38260015)
It's not the case for this example of ffmpeg (it's actually not patched), but make sure to check the actual changelog. Sometimes the version is kept, but the patches are backported, so a plain version comparison is not enough.
[ Parent | on HN ]
Re:Yes, Ubuntu is withholding security patches for some soft... by diffeomorphism on Tuesday November 14, 2023 @03:36AM (#38260621)
That is also absolutely unchanged compared to "since forever". Canonical supports "main", while "universe" and "multiverse" offer best-effort community support (aka from debian). They now additionally offer a dedicated team for those repos.

Honest question, since the arch wiki seems surprisingly spotty on this: Which arch repos are covered by their security team? Just core? Or also extra? More than that? AUR surely not, right?

[ Parent | on HN ]
Re:Yes, Ubuntu is withholding security patches for some soft... by guappa on Tuesday November 14, 2023 @03:46AM (#38260681)
Not even "from debian". Sometimes they can't be bothered to copy debian packages that fix security issues if the package is in universe, and just leave it vulnerable for the entire duration of the LTS.

Happened to me.

[ Parent | on HN ]