Yea. Fedora has been one of my favorite OS's for years, but exactly what you describe "If one compromised update snuck this guy in.." has spooked me to something with a much slower release cadence. I guess I accept that more unpatched known vulns stick around, but yea when I start thinking about how many software packages -> the number of devs, build systems, etc. It just gets overwhelming thinking about how many threat actors are probably trying to get in from each avenue.

I'd love to hear other takes on this though... Current thought is to just use something with a whole lot of exposure, in a whole lot of environments, pretty far downstream so the package hits all of that exposure, and hope someone spots it, kinda like xz. I tend to keep my base OS extremely minimal and do all my real work in VMs.

▲

jgraettinger1 4 hours ago | parent [-]

The contra is that “stable” releases are now a liability, because it takes longer for upstream fixes to be back-ported. Recently, for bugs that are quickly exploitable in the wild.

A recent example is the TCP options use-after-free, where it took Canonical a couple days to patch LTS beyond when the fix was first available in Fedora 45.

And these are just for public CVEs. I’m also worried that there are a lot of quiet fixes being made with new agentic review tooling, which may fix an undiscovered bug but will never be back-ported.

	▲	tavavex 3 minutes ago \| parent \| next [-]
		Damned if you, damned if you don't. Update constantly and you might get a fun little surprise shipped to you in one of the updates. Update occasionally and you'll miss the critical fix(es) to a vulnerability you have. I think the only way out is extreme scrutiny of all updates and paranoid minimization of all attack vectors, but the industry is only going to settle into that local minimum after we go through some devastating breaches.
	▲	leafletsigh 3 hours ago \| parent \| prev [-]
		Yea I should have put it in my first post, but that is the one I have come across a lot reading some of the package maintainers comments from fedora on reddit. It's a really good point. Thanks!