| ▲ | voakbasda 4 hours ago |
| Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”. Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer. |
|
| ▲ | InsidiousWombat 4 hours ago | parent | next [-] |
| Plain Debian was always best option; even RHEL dropped the ball on this CVE and that's distro people pay for support |
| |
| ▲ | thayne 3 hours ago | parent | next [-] | | Not always. Notably, if you have compliance requirements like needing FIPS encryption (say because you have government customers), or that requires you to use a commercial vendor, debian won't work. And if you need more up to date system packages, or a reliable release cadence, Ubuntu might be better. On desktop, if you need proprietary drivers, Ubuntu is easier to set up. But yes, if debian works for you, I wouldn't use Ubuntu. | | |
| ▲ | bityard an hour ago | parent | next [-] | | I had to deal with FIPS once because the company I worked for shipped a custom Linux distribution with the product and we had to essentially shoe-horn in some Red Hat OpenSSL packages to get it to meet FIPS requirements. What's funny is that after the customer enabled FIPS, administration became much harder, and the encryption strength was strictly worse. Anyway, needing FIPS is something of a niche requirement. Debian or Rocky are very sane choices as a default Linux distribution for general-purpose servers until you run up against special requirements. | |
| ▲ | bubblethink 2 hours ago | parent | prev | next [-] | | What is FIPS encryption, why is FIPS unique to RHEL, and what has FIPS got to do with this CVE? | | |
| ▲ | saghm 2 hours ago | parent | next [-] | | FIPS is a US government security standard: https://en.wikipedia.org/wiki/FIPS_140 It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification. | |
| ▲ | CodesInChaos 11 minutes ago | parent | prev | next [-] | | It's about using a certified cryptography implementation. Presumably RHEL has such a certification, while Debian has a compliant but uncertified implementation. This isn't relevant to the CVE, but counters the claim that Debian is always a suitable choice of distribution. | |
| ▲ | john_strinlai 2 hours ago | parent | prev [-] | | >What is FIPS encryption presumably they mean meeting fips standards https://en.wikipedia.org/wiki/FIPS_140 >why is FIPS unique to RHEL its not >what has FIPS got to do with this CVE? it doesnt. it is brought up in reply to the comment. |
| |
| ▲ | b112 2 hours ago | parent | prev [-] | | Uh, yes it will. OpenSSL in Trixie is a version supported. https://packages.debian.org/trixie/openssl-provider-fips It's just the library, nothing special about the OS. https://csrc.nist.gov/projects/cryptographic-module-validati... As far as I know, compliance comes with an external module: https://openssl-library.org/post/2025-03-11-fips-140-3/ This module seems to be in Debian: # apt-cache search fips | grep open
openssl-provider-fips - Secure Sockets Layer toolkit - cryptographic utility # dpkg -L openssl-provider-fips
/.
/usr
/usr/lib
/usr/lib/x86_64-linux-gnu
/usr/lib/x86_64-linux-gnu/ossl-modules
/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so
/usr/share
/usr/share/doc
/usr/share/doc/openssl-provider-fips
/usr/share/doc/openssl-provider-fips/changelog.Debian.gz
/usr/share/doc/openssl-provider-fips/changelog.gz
/usr/share/doc/openssl-provider-fips/copyright There seems to be the validation process, which supposedly must run on
each machine it is used on. openssl fipsinstall -out /tmp/configfile.cnf -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so 2>&1 | tee /tmp/result.txt -- The above are from my notes, and a test run. But I don't see how Redhat is "special" here. If the module loads and cites compliance, you comply. | | |
| ▲ | thayne an hour ago | parent [-] | | > OpenSSL in Trixie is a version supported. It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module. > It's just the library, nothing special about the OS. If you need validation, then the kernel also need to be validated. Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse. |
|
| |
| ▲ | pmontra an hour ago | parent | prev | next [-] | | I planned to install Debian in 2009 and in 2014 but the installer was too hard to use, the desktop in 2009 was ugly (maybe in 2014 too), I could not get a running system that I could use to work. Fast forward to Debian 10, same laptop from 2014, and I got a desktop identical to Ubuntu GNOME. | |
| ▲ | bigfatkitten an hour ago | parent | prev | next [-] | | Red Hat is always slow in backporting patches to their Frankenkernel. | |
| ▲ | johnnyenn 32 minutes ago | parent | prev [-] | | [flagged] |
|
|
| ▲ | xnickb 4 hours ago | parent | prev | next [-] |
| The general advice I've been seeing the past ~8 years is "There is no reason to pick Ubuntu over Debian". I don't know who the opposite advice comes from and why anyone would pick ubuntu for a server. |
| |
| ▲ | alexjplant 4 hours ago | parent | next [-] | | 15-20 years ago the joke was that Ubuntu is a Zulu word that, roughly translated, means "I don't know how to configure Debian". Ubuntu was one of the first distros that allowed one to easily download proprietary WLAN drivers without dealing with the terminal, ndiswrapper, or compiling half-broken OSS implementations; for this reason it caught fire with those who wanted to try Linux but were otherwise unwilling to engage in such shenanigans. I tried it on a laptop around this time and was quite impressed. This reputation for "it just works" has carried them ever since even though other distros now do largely the same thing ( cheap, obscure, or recently-released hardware excepted). I took the lazy Mint route with my most recent machine since I wanted to use it for light gaming with minimal fuss. I'm going to redo it with Nix sometime soon because the value prop simply isn't there and I'd like to try a declaratively-configured distro. | | |
| ▲ | graemep 17 minutes ago | parent | next [-] | | > Ubuntu was one of the first distros that allowed one to easily download proprietary WLAN drivers without dealing with the terminal, ndiswrapper, or compiling half-broken OSS implementations None of which was a good reason to use it on servers. Even if you were familiar with Ubuntu there is very little difference between an Ubuntu server and a Debian one. | |
| ▲ | marcosdumay an hour ago | parent | prev | next [-] | | More like 20. If I remember it right, by 2007 the Debian community was angry discussing the installation team's decision to include non-free packages in the installation media, what ended the problem of needing a wired connection during the install. | |
| ▲ | benj111 2 hours ago | parent | prev | next [-] | | They also sent out free distro CDs. That helped convince me this new fangled Linux thing might be legitimate. Christ that was 2008.18 years ago. My Linux 'experiment' is old enough to vote | | |
| ▲ | kiicia 2 hours ago | parent [-] | | I have received cds with ubuntu 5 or 6, was surprised they actually sent those, but at one point I started using it [edit] omg circa 2006, firefox was still new back then |
| |
| ▲ | throe937383030 3 hours ago | parent | prev [-] | | [flagged] |
| |
| ▲ | jandrese 3 hours ago | parent | prev | next [-] | | I advocated for Ubuntu for years because it was easier to install and had excellent hardware support. For 2026 I have switched back to Debian because Ubuntu has been making my life more difficult. Ubuntu 26 basically forces you onto Wayland even though it breaks some of my use cases, particularly with screen recording. It turns everything into Snaps which is a hassle because it means I need to mirror both the regular repo and the snaps to my closed network instead of just the repo. Ubuntu still has the superior installer by a good margin, but it does sometimes like to crash when run offline. Debian's installer at least has the option to go text only. There is also more work to do after the install is finished on Debian, but since that's a script it's not such a big deal. The one bit of the Debian installer I dislike the most is how if you aren't online when you do the install you get a completely empty sources.list, and the Debian sources are a lot more complicated than Ubuntu's. Debian's support for third party drivers like nVidia graphics is also more complicated and confusing than Ubuntu's. | |
| ▲ | p91paul 4 hours ago | parent | prev | next [-] | | Enterprises love paying for support contracts. If you have one, you can demonstrate something has been accounted for. A secure software without support is worse from an audit perspective than a security disaster with proper paperwork.
Most of these people never actually involve support they paid for ever. | | |
| ▲ | notpushkin 4 hours ago | parent | next [-] | | > Enterprises love paying for support contracts. They can pay for Debian support! (I’m not 100% sure who they should go to, but e.g. Freexian are doing Extended LTS for Debian [1], so I suppose they could do a regular support contract as well?) [1]: https://wiki.debian.org/LTS/Extended | |
| ▲ | xnickb 4 hours ago | parent | prev [-] | | A quick search shows all sorts of projects choosing Ubuntu. Can you explain a project like mail-in-a-box going with it? And 5.15 kernel at that.. | | |
| ▲ | voakbasda 4 hours ago | parent [-] | | People make bad choices all the time for many different reasons. Usually, “it seemed like a good idea at the time” is at the top of that list. | | |
| ▲ | bityard an hour ago | parent [-] | | But by definition it wasn't a bad choice (or a mistake) if it seemed like the right choice given the information available at the time. Unless you have some sort of crystal ball the rest of us don't. |
|
|
| |
| ▲ | bityard an hour ago | parent | prev | next [-] | | I deployed Ubuntu on a LOT of servers 10 years ago because at the time, they had a track record of doing good things in, with, and for, the Linux and open source community. I had already been using it on the desktop for a long time by that point and knew it well. Ubuntu was far and away the most popular; it was a very safe and sane choice. That changed when they started heavily promoting Snaps as the next big thing and started putting features and updates behind their enterprise offerings. Basically, they stopped being "Debian, but better." And Debian also made lots of incremental improvements in user-friendliness in that time. Basically, Debian is now pretty much what Ubuntu always promised to be. | |
| ▲ | sgarland 2 hours ago | parent | prev | next [-] | | The only recent reason I’ve managed to come up with is it far and away has the best support for Nvidia’s various drivers and utilities for running GPUs and its assorted ecosystem, like Infiniband and Spectrum-X Ethernet. If there’s another option I’m unaware of, I’d love to hear it. Also to be fair, I didn’t evaluate Sid for this, only Stable. | |
| ▲ | BoppreH 4 hours ago | parent | prev | next [-] | | Platform support. Oracle Cloud for example only provides images[1] for Oracle Linux, RHEL, Ubuntu, and Windows Server. Anything else you have to bring your own. [1] https://docs.oracle.com/en-us/iaas/Content/Compute/Reference... | | |
| ▲ | rezzo 3 hours ago | parent [-] | | If I try to create a new instance on Oracle Cloud, these are the options: Oracle Linux, Ubuntu, RHEL, (CentOS), Windows Server, AlmaLinux, Rocky Linux. Anyway you are right, I would have switched already if Debian was available. I guess AlmaLinux could be an option to consider, since I've read in another comment that they've patched ahead of upstream for several vulnerabilities this year. | | |
| ▲ | kqgnkqgn 2 hours ago | parent [-] | | For x86_64, It's relatively easy-ish to upload your own Debian image, from Debian's generic cloud QCOW2 image, and it works just fine. I think ARM needs a bit more work if I remember correctly. (But 100% agree this shouldn't be necessary). |
|
| |
| ▲ | gambiting an hour ago | parent | prev [-] | | I've set up a new server literally couple weeks ago on a droplet on Digital Ocean - Ubuntu LTS is the default choice(you can select other distros but Ubuntu is the default). So I guess I picked Ubuntu because I haven't done Linux admin in over a decade and it's presented as the default choice by a big cloud provider. |
|
|
| ▲ | vbezhenar 4 hours ago | parent | prev [-] |
| What's your recommendation nowadays? |
| |