Plain Debian was always best option; even RHEL dropped the ball on this CVE and that's distro people pay for support

Not always. Notably, if you have compliance requirements like needing FIPS encryption (say because you have government customers), or that requires you to use a commercial vendor, debian won't work. And if you need more up to date system packages, or a reliable release cadence, Ubuntu might be better.

On desktop, if you need proprietary drivers, Ubuntu is easier to set up.

But yes, if debian works for you, I wouldn't use Ubuntu.

▲

bityard 2 hours ago | parent | next [-]

I had to deal with FIPS once because the company I worked for shipped a custom Linux distribution with the product and we had to essentially shoe-horn in some Red Hat OpenSSL packages to get it to meet FIPS requirements. What's funny is that after the customer enabled FIPS, administration became much harder, and the encryption strength was strictly worse.

Anyway, needing FIPS is something of a niche requirement. Debian or Rocky are very sane choices as a default Linux distribution for general-purpose servers until you run up against special requirements.

▲

bubblethink 4 hours ago | parent | prev | next [-]

What is FIPS encryption, why is FIPS unique to RHEL, and what has FIPS got to do with this CVE?

	▲	saghm 3 hours ago \| parent \| next [-]
		FIPS is a US government security standard: https://en.wikipedia.org/wiki/FIPS_140 It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification.
	▲	CodesInChaos 2 hours ago \| parent \| prev \| next [-]
		It's about using a certified cryptography implementation. Presumably RHEL has such a certification, while Debian has a compliant but uncertified implementation. This isn't relevant to the CVE, but counters the claim that Debian is always a suitable choice of distribution.
	▲	john_strinlai 4 hours ago \| parent \| prev [-]
		>What is FIPS encryption presumably they mean meeting fips standards https://en.wikipedia.org/wiki/FIPS_140 >why is FIPS unique to RHEL its not >what has FIPS got to do with this CVE? it doesnt. it is brought up in reply to the comment.

▲

b112 4 hours ago | parent | prev [-]

Uh, yes it will. OpenSSL in Trixie is a version supported.

https://packages.debian.org/trixie/openssl-provider-fips

It's just the library, nothing special about the OS.

https://csrc.nist.gov/projects/cryptographic-module-validati...

As far as I know, compliance comes with an external module:

https://openssl-library.org/post/2025-03-11-fips-140-3/

This module seems to be in Debian:

# apt-cache search fips | grep open openssl-provider-fips - Secure Sockets Layer toolkit - cryptographic utility

# dpkg -L openssl-provider-fips /. /usr /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/ossl-modules /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so /usr/share /usr/share/doc /usr/share/doc/openssl-provider-fips /usr/share/doc/openssl-provider-fips/changelog.Debian.gz /usr/share/doc/openssl-provider-fips/changelog.gz /usr/share/doc/openssl-provider-fips/copyright

There seems to be the validation process, which supposedly must run on each machine it is used on.

openssl fipsinstall -out /tmp/configfile.cnf -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so 2>&1 | tee /tmp/result.txt

The above are from my notes, and a test run. But I don't see how Redhat is "special" here. If the module loads and cites compliance, you comply.

▲

thayne 3 hours ago | parent [-]

> OpenSSL in Trixie is a version supported.

It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module.

> It's just the library, nothing special about the OS.

If you need validation, then the kernel also need to be validated.

Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse.

	▲	tosti 25 minutes ago \| parent [-]
		I compile software every day. There's nothing difficult about it until cmake starts complaining, but I've got it back on track every time.

▲

pmontra 2 hours ago | parent | prev | next [-]

I planned to install Debian in 2009 and in 2014 but the installer was too hard to use, the desktop in 2009 was ugly (maybe in 2014 too), I could not get a running system that I could use to work. Fast forward to Debian 10, same laptop from 2014, and I got a desktop identical to Ubuntu GNOME.

▲

bigfatkitten 2 hours ago | parent | prev | next [-]

Red Hat is always slow in backporting patches to their Frankenkernel.

▲

noir_lord 37 minutes ago | parent | prev | next [-]

[dead]

▲

johnnyenn 2 hours ago | parent | prev [-]

[flagged]