Not always. Notably, if you have compliance requirements like needing FIPS encryption (say because you have government customers), or that requires you to use a commercial vendor, debian won't work. And if you need more up to date system packages, or a reliable release cadence, Ubuntu might be better.

On desktop, if you need proprietary drivers, Ubuntu is easier to set up.

But yes, if debian works for you, I wouldn't use Ubuntu.

▲

bityard 4 hours ago | parent | next [-]

I had to deal with FIPS once because the company I worked for shipped a custom Linux distribution with the product and we had to essentially shoe-horn in some Red Hat OpenSSL packages to get it to meet FIPS requirements. What's funny is that after the customer enabled FIPS, administration became much harder, and the encryption strength was strictly worse.

Anyway, needing FIPS is something of a niche requirement. Debian or Rocky are very sane choices as a default Linux distribution for general-purpose servers until you run up against special requirements.

	▲	thayne an hour ago \| parent [-]
		> Anyway, needing FIPS is something of a niche requirement. For sure. Most of the time, Debian is just fine. But sometimes, if you have special requirements, something else might be better.

▲

bubblethink 6 hours ago | parent | prev | next [-]

What is FIPS encryption, why is FIPS unique to RHEL, and what has FIPS got to do with this CVE?

	▲	saghm 5 hours ago \| parent \| next [-]
		FIPS is a US government security standard: https://en.wikipedia.org/wiki/FIPS_140 It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification.
	▲	CodesInChaos 3 hours ago \| parent \| prev \| next [-]
		It's about using a certified cryptography implementation. Presumably RHEL has such a certification, while Debian has a compliant but uncertified implementation. This isn't relevant to the CVE, but counters the claim that Debian is always a suitable choice of distribution.
	▲	john_strinlai 5 hours ago \| parent \| prev [-]
		>What is FIPS encryption presumably they mean meeting fips standards https://en.wikipedia.org/wiki/FIPS_140 >why is FIPS unique to RHEL its not >what has FIPS got to do with this CVE? it doesnt. it is brought up in reply to the comment.

▲

b112 6 hours ago | parent | prev [-]

Uh, yes it will. OpenSSL in Trixie is a version supported.

https://packages.debian.org/trixie/openssl-provider-fips

It's just the library, nothing special about the OS.

https://csrc.nist.gov/projects/cryptographic-module-validati...

As far as I know, compliance comes with an external module:

https://openssl-library.org/post/2025-03-11-fips-140-3/

This module seems to be in Debian:

# apt-cache search fips | grep open openssl-provider-fips - Secure Sockets Layer toolkit - cryptographic utility

# dpkg -L openssl-provider-fips /. /usr /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/ossl-modules /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so /usr/share /usr/share/doc /usr/share/doc/openssl-provider-fips /usr/share/doc/openssl-provider-fips/changelog.Debian.gz /usr/share/doc/openssl-provider-fips/changelog.gz /usr/share/doc/openssl-provider-fips/copyright

There seems to be the validation process, which supposedly must run on each machine it is used on.

openssl fipsinstall -out /tmp/configfile.cnf -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so 2>&1 | tee /tmp/result.txt

The above are from my notes, and a test run. But I don't see how Redhat is "special" here. If the module loads and cites compliance, you comply.

▲

thayne 4 hours ago | parent [-]

> OpenSSL in Trixie is a version supported.

It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module.

> It's just the library, nothing special about the OS.

If you need validation, then the kernel also need to be validated.

Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse.

▲

tosti 2 hours ago | parent [-]

I compile software every day. There's nothing difficult about it until cmake starts complaining, but I've got it back on track every time.

	▲	jacobgkau an hour ago \| parent [-]
		Companies who care about whether their FIPS implementation is validated or not would probably prefer buying from a company who sells it over relying on a guy at their company to get cmake back on track regularly. At that point, it's not just about the module, it's about custody, liability, etc.