News for hackers. Stuff that matters.
Re:xz: A Microcosm of the interactions in Open Source projects by stavros on Sunday March 31, 2024 @06:16AM (#39882949)
I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.
Re:xz: A Microcosm of the interactions in Open Source projects by mikeocool on Sunday March 31, 2024 @08:21AM (#39883613)
Fortunately, it didn’t make it into an Ubuntu release: https://discourse.ubuntu.com/t/xz-liblzma-security-update/43...

Though it was frighteningly close, 24.04 is scheduled to be released on April 25.

Re:xz: A Microcosm of the interactions in Open Source projects by stavros on Sunday March 31, 2024 @08:29AM (#39883660)
Wow, ok, that's close. I wonder how many have actually made it.
Re:xz: A Microcosm of the interactions in Open Source projects by spacemanspiff01 on Sunday March 31, 2024 @07:46AM (#39883363)
My impression is that it did not get into latest Ubuntu, they were in the process of trying though.

The end goal seems to have been to get it into the LTS releases of rhel and Ubuntu. Since this was a valuable it's probably something kept around for when other methods fail. I doubt it would be used before the really valuable systems are compromised (rhel and Ubuntu in cloud and governments)

Re:xz: A Microcosm of the interactions in Open Source projects by cassianoleal on Sunday March 31, 2024 @10:45AM (#39884742)
I don't personally know anyone who would run any Debian release that's not stable on production systems. On your desktop? Fine. I do it myself. On a server, with ports open to the public Internet that's a big nope.

There's nothing wrong with Debian stable having years-old packages either. In any case:

> The current "stable" distribution of Debian is version 12, codenamed bookworm. It was initially released as version 12.0 on June 10th, 2023 and its latest update, version 12.5, was released on February 10th, 2024.

https://www.debian.org/releases/

That's just over 1 year. Sure, packages themselves will be older than that since they take some time soaking frozen in testing before they become part of stable but that's generally a good thing.

In any case, if there's pressing need for some newer packages, it's always possible to use apt pinning to pull those on top of a stable base.

Re:xz: A Microcosm of the interactions in Open Source projects by stavros on Sunday March 31, 2024 @10:52AM (#39884795)
I didn't say there's anything wrong, I meant that choosing the OS distribution with the oldest packages isn't an indication for how widespread the distribution of this package was.
Re:xz: A Microcosm of the interactions in Open Source projects by cassianoleal on Sunday March 31, 2024 @12:11PM (#39885492)
I was initially responding to

> > It made it to production, for a long time

I never said it didn't make it to production. I was asking if that's the case, and giving one data point.

It apparently didn't make it into Ubuntu LTS either, so there's another one.

If you have information that proves or disproves either point, please present it.