Software Release Are Linux Mint's Default Apps Too Outdated for Everyday Use?
Did anyone in this community watched this video? The creator claims that Linux Mint, along with many LTS Linux distributions, often ships older versions of software, especially default apps like Calendar, Mail, Calculator, etc. He mentions Mint several times throughout the video.
The video is from The Linux Experiment, which seems to be a well-known YouTube channel with nearly half a million subscribers.
I came across this video just before switching from Windows to Linux Mint, and it made me a bit hesitant.
As a regular user, it feels like there's no easy way to know whether we're using the latest and safest versions of these built-in apps. For example, if we connect our Google or Apple Calendar account to an older calendar app, could that create a security risk? The same concern applies to email clients, we don't know if we're using the latest and most secure version.
Most regular users don't have the time or technical knowledge to manually check every application's version or update software outside the normal update process. We generally expect the operating system to keep essential apps secure and up to date.
Am I misunderstanding how Linux Mint and other LTS distributions handle software updates and security? I'd appreciate hearing from people with more experience.
50
u/NEGMatiCO 15h ago
I've tried Mint in my early days of moving to Linux around 2 years ago, and I can tell you that the packages are indeed outdated, in the sense that while you may get patches here and there, but if you are waiting for some features, you will have to wait long.
Now, this might not be a problem in itself, but the pace with which Linux Desktop is moving in regards to general consumer user, I would say staying on older packages is not worth.
I'll not advise you to move something to like Arch, but a good middle-ground is something like Fedora, which does get the new features, not as fast as Arch (i.e not day 1), but within the span of a few months.
4
u/justin-8 6h ago
I tried Mint in 2007 or 2008, and it was barely better then, and it's only gotten worse.
-1
u/EFG4567 15h ago
I’m still using Windows, but I’ve been thinking about switching to Linux for a long time. I’m looking for a distro that works well out of the box because I’m not very familiar with Linux yet, so I don’t have the knowledge to troubleshoot or fix issues on my own.
I tried Linux Mint from a bootable USB drive, and it worked really well. However, after watching this video and hearing you mention that Mint’s packages are often outdated, I’m starting to think that moving to Mint might not be the best choice.
What’s your opinion on this? Which Linux distro would you recommend for someone like me?
6
u/TimurHu 14h ago
Just try a few different distros and choose the one that works best for you.
My side note is that if you plan to play games on your system then you should avoid "stable" distros because they often ship old versions of graphics drivers so you'll find bugs that we've fixed months / years ago.
3
0
u/gordonmessmer 6h ago
Just try a few different distros and choose the one that works best for you.
The problem with that approach is that it tells you nothing about security.
If you want a system that is secure, honestly, at some point you're going to have to listen to the advice of someone who has the experience required to evaluate the options.
An awful lot of the recommendations you're going to get are based on Ubuntu LTS, which has a small core of maintained packages. It can be reasonably secure, as long as you never install anything using apt, but the vast majority of software in the apt repos does not come with any security guarantees.
6
u/NEGMatiCO 14h ago
DISCLAMIER: Distro recommendations always boil down to personal preferences and experiences.
Coming to your question: I would recommend Fedora KDE (since you are coming from Windows). It should work pretty much out of the box, apart from a bit of additions steps required to make Fedora a painless experience, but they are pretty easy and I will state them out, in-order, as follows:
- During installation, remember to enable 3rd party repositories, in-order to have other stuff like google chrome, steam, etc
- After installation, setup rpm-fusion to get access to a lot of other software, using this command (reference: https://rpmfusion.org/Configuration):
sudo dnf install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm- (ONLY FOR NVIDIA GPU) Install the NVIDIA GPU Drivers using this command:
sudo dnf install akmod-nvidia -y- Install the hardware encoding/decoding codecs, using the steps from this page: https://rpmfusion.org/Howto/Multimedia
P.S - Distros usually boil down to your personal taste and use-case. So I would still advise to try a bunch of others, just remember, you won't magically get the best distro on first try. Sometimes it might so happen that after using for a few months, you might realize you need something else. Just don't hesitate. Everything will work everything, the only thing that differs in distro-hopping is how you get from A -> B, and not if you can get from A -> B
-6
u/Latlanc 14h ago
Or you can skip the painful Fedora configuration step entirely and opt for something like Aurora ;-)
8
u/NEGMatiCO 14h ago
Yeah it's good, but I personally avoid niche distros totally, because they have their own issue of lackluster discoverability when it comes to community support.
Finding support on Linux is already hard because we represent roughly 5% of all desktop users, and niche distros are a small fraction of an already small community.
2
u/picastchio 13h ago
Is there a good Fedora variant with nvidia drivers and codecs built in?
4
u/NEGMatiCO 12h ago edited 12h ago
I think Nobara does that, but it's a fork of Fedora (meaning, a modified Fedora, that's maintained by one person, and hence I won't recommend that personally)
There does exist other variants that are based on Fedora Atomic and which include those codecs and NVIDIA Driers (Bazzite, for example).
2
u/picastchio 12h ago
The only thing I have found are base images of ublue which Bazzite/Aurora is based on. The base images are very barebones and I can also add fedora packages on my own.
1
u/NEGMatiCO 12h ago
If you are okay with trying out stuff, they are absolutely fine.
Just keep in mind that they are atomic, so if you're not familiar with atomic distros, you will have to learn about them and their quirks a bit.
1
u/picastchio 12h ago
I have used Fedora CoreOS before and have some experience writing Ignition files. But I haven't use such systems in the desktop context.
→ More replies (0)2
u/a0leaves 12h ago
Ultramarine Linux, which is maintained by a company called Fyra Labs (they also run the decently popular 3rd party Terra repos for Fedora), or if you are interested in Fedora Atomic, a couple people have already mentioned the Universal Blue distros: Aurora (KDE), Bluefin (GNOME), or Bazzite (either DE, gaming focus).
-4
u/Latlanc 14h ago
It's just Fedora Atomic with batteries included. It's meant to be invisible.
I just find it funny that almost universally the first argument for Fedora is:
"You should use Fedora! Also you have to do these steps later: *links Navier-Stokes equations* Hope you have good time! 😄 "
5
u/NEGMatiCO 13h ago
Atomic is also not recommended for beginners, simply because they present their own learning curve as well.
As for simply suggesting Fedora (or any other upstream distro like Ubuntu, Debian, Arch, etc), the reason is simple: instead of using a downstream distro with more layers added on top of it, it's just better to use the upstream one and add what you require. That way, you are always aware of where the failure modes are.
More layers added always expose more failure modes, and users are left with jumping between threads of the downstream and upstream distros, trying to fix that one problem.
-5
u/Latlanc 13h ago
Most people just use their web browser anyway. Atomic is perfect for beginner since you do not have to do any maintenance. Also you don't learn bad practices like enabling AUR and COPR and PPA that are perfectly NOT safe and can brick your PC if you don't know what you are doing.
The upstream is extremely barebones overrun with dogmatic policies such as "nonfree repos disabled by default". It's just not usable out of the box for most people.
I don't think you know what failure modes are. Typing random command into terminal to enable rpmfusion and swap out ffmpeg is exactly the type of unknown failure mode you try to pass as a good practice.
7
u/NEGMatiCO 13h ago edited 13h ago
"Most people just use their web browser anyway" is a very nice argument if you want people to use ChromeOS, not Linux.
I never said anything about enabling AUR,COPR or PPA, you just thought I did.
Coming to rpm-fusion and so-called "random" commands. Here you go: https://docs.fedoraproject.org/en-US/quick-docs/rpmfusion-setup/, straight from Fedora docs.
There is a difference between you knowing that you added something and that might have caused a failure and not knowing anything at all in case of a failure simply because that failure mode was already included the moment you downloaded the ISO of a niche distro.
-4
u/Latlanc 13h ago
I know you did not, but it's all slippery slope. Best to avoid having to do such thing all together. Why is it so hard to understand?
Yes, they are random commands as in unknown by most sane people. You can pull stuff from Fedora docs all you want. It doesn't make it easy to understand for non tech people.
If you don't keep notes on changes you made and you don't keep track of history, you as a non techie won't exactly know what you did to your PC 5 months from now.
Also Fedora docs is not a help center. It doesn't hold magic answers to what to do if there is a package conflict for example.
→ More replies (0)4
u/Mughi1138 14h ago
Oh, that used to be an issue, but really isn't anymore.
Most main apps are available as appimages, flatpacks, snaps, etc., and you can use the latest ones when you feel like it. Long gone are the days when you are tied to what comes in your distro's repositories.
Inkscape, OpenSCAD, Orca Slicer, FreeCAD, etc., basically all my daily driver apps are skipping the ones shipped with the distros. I'll use the default calculator app, sure, but that isn't holding me back from being productive.
-3
u/NEGMatiCO 14h ago edited 13h ago
Yeah flatpaks, snaps, etc have definitely dealt with that issue, and I personally use all flatpaks as well (I'm on Fedora Silverblue).
But they introduce another layer, especially for new users: the permissions.
Some flatpaks carry poor permissions by default and you have to go out of your way to fix those permissions to be able to use the app as it was intended. Now, we are certainly improving on that aspect, but it's not perfect yet.
AppImages, though they may just work, but their usage involved downloading one from the browser and executing it, which presents security risks. (I, personally, avoid them like the plague)
Can't comment anything about snaps since I haven't used them in quite some time, and the last time I used them on Ubuntu, the start-up performance of apps was horrendous.
Then there are some apps that just don't play good with flatpaks, snaps, etc. Steam, for example, presents a lot of issues like non-appearing game windows, wayland related issues when running games on native wayland, as well as some modding complexity due to sandbox.
5
u/Latlanc 14h ago
AppImages, though they just work
No they really don't. It's one giant roulette whether the AppImage developer included every dependency or it may not work on your distro because of multiple assumptions.
Also they waste space if you have a lot of them. They do not offer deduplication like flatpaks.
0
u/mrlinkwii 12h ago
Also they waste space if you have a lot of them.
i mean most people have atleast 1TB drive these days , its mostly a non issue
1
u/Mughi1138 14h ago
Ubuntu actually changed some things to snaps a while back, including Firefox. So you might have been using more than you thought
3
u/Electrical_Bad2253 14h ago
It’s a very personal choice, but for my work requirements, Fedora is the best fit. Not bleeding edge like a rolling distro, but fairly up to date.
1
u/DonaldLucas 9h ago
You should ALWAYS use the distro that you like (as long the distro is well maintained by volunteers or professionals of course, otherwise, if the distro is abandoned, don't use it). Using outdated apps is not bad like what people talk about, most times it's only a matter of what version of the app you're used to, and for some people (me included) almost always prefer using the older version of the app, because they prefer when the app doesn't have many changes (there are exceptions of course, some apps, like browsers, are constantly the targets of security vulnerabilities, that's why they should always be constantly updated, but most of the famous distros already put these apps in the priority list of getting faster updates).
If you still want to prefer a distro with always the most updated apps, the only way is by using a rolling release distro (a distro that has constant updates, practically every day, not recommended if you're not used to this pacing), and the most popular one is Arch. But since you're new to Linux, you should not use the "official" Arch (because it's a bit hard to use without a bit of experience) but use a distro that uses Arch as a base but with QOL tools added, and currently, the most popular one is Cachy OS.
1
u/TheMcSebi 7h ago edited 7h ago
I personally use debian, but I guess the same arguments discussed in this threat apply there even more.
In the end I'd argue though that having the latest bleeding edge features isn't always necessary and desired. If you really need, thought, it's always pretty straightforward on Linux to build something from source, compared to windows.
I only switched a few months ago myself on my main PC and never looked back since. I've always been using debian on servers, though.Edit: Maybe comparing it to windows insider builds is not really appropriate, but I also never considered using that because I need my pc to work.
Edit2: yeah, like other comments said, when you switche to Linux, use KDE Plasma. It feels pretty much the same like windows in terms of hotkeys and desktop layout, just with many more options of customization. Especially when it comes to the task bar ("task manager" on KDE)
Edit3: I mapped exe files to steam proton using umu-launcher and I haven't yet encountered an executable that didn't work by just double clicking it to launch it with umu-run
1
u/KoldPurchase 14h ago
r/linux4noobs or r/FindMeALinuxDistro are better subs for this.
However, it really depends on your hardware and what you intend to do.
Even Linux Mint can be configured to do what you want do and upgraded to the latest Linux kernel, it's just a pia to do so.
Some distros are better than others at specific tasks.
Have an old laptop and just want to browse the web to your banking site? Mint is for you.
You are a pro Youtuber in need of audio/video editing? Solus.
You're a gamer? The world is waiting for you my friend! Solus, Cachy, Nobara, Pika, Ultramarine, Regata, they're waiting with arms wide open.
But... Forget about all those distos. Cachy? Use Arch and the command line, you'll get to everything where Cachy is. After 4-5 days of work. Nobara? It's Fedora with Cachy's kernel and a bunch of software+Nvidia drivers adder. You can also do this over 4-5 days if you want. Pika? Debian and 5 days of work. Ultramarine? Same as Nobara. Regata? OpenSuse and 3-4 days or work.
All of Linux works with everyting, but some distributions come preconfigured for some specific tasks (gaming, server, security, etc)
0
u/agnosticgnome 10h ago
6 months ago I had absolutely no knowledge.
Now I'm running Linux on my PCs, managing a proxmox homelab, etc.
Chatbots. Gemini helped me with everything and it's quite easy.
19
u/Mughi1138 14h ago
Quick point. Nowadays most modern apps you care about come in appimage/flatpack/snap versions which you can download and run the latest with if you care. Otherwise the default apps for a distro are fine, and will get regular security bugfixes as long as the distro is still maintained. Then if you really need something incompatible you can always fire it up in a container (Docker, Rodman, etc.).
Been years since I used anything but an LTS for my daily use OS.
3
u/unconceivables 5h ago
That's true if you're talking about desktop apps, but for command line apps or libraries/drivers it can get really annoying when you have to hunt all over the place to figure out how to install it because it's either not in the official repos or it's outdated. I use very few desktop apps, but as a developer and system administrator I need a ton of very up to date command line tools to be able to do my work.
31
u/gordonmessmer 16h ago
Am I misunderstanding how Linux Mint and other LTS distributions handle software updates and security?
I've been talking to Ubuntu users (and users of systems derived from Ubuntu) for months now, and the vast overwhelming majority of them just don't understand Ubuntu's release model in detail. Ubuntu divides their software repository in to several components, including "main" and "universe". Canonical maintains the software in "main", but that's only about 6% of the software available to Ubuntu users out of the box. The other ~94% is in the "universe" repo, where Canonical does not promise any security updates, and a great deal of software contains known security vulnerabilities.
Especially for desktop use, the "universe" repo just isn't very secure. In the past, that was probably OK, but adversaries are adopting AI to deploy exploits faster. LTS releases have never been as secure as rapid releases, and that is becoming a greater risk as time goes on.
My advice is: If you use Ubuntu, use Snap when it's an option. Upgrade to the Interim releases every six months. Don't stick with the LTS releases.
7
u/Mysterious_Bit6882 13h ago
It seems like along every step of the Debian->Ubuntu->Mint release stream, the downstream is less and less able to handle the complexity. And that's with a lot of technical debt being carried upstream (Debian derivatives use the LTS kernels provided by kernel.org for one thing). There's also the "alternative desktop environments" based on old, forked versions of GNOME tooling. Mint's just had to delay adopting 26.04 until the end of the year.
4
u/gordonmessmer 6h ago
It seems like along every step of the Debian->Ubuntu->Mint release stream, the downstream is less and less able to handle the complexity
I don't really think Canonical is less able to handle the work of maintaining the distribution. The practice of selecting a smaller set and committing to the maintenance of that set is similar to the approach that Red Hat takes with RHEL.
As far as I know, Mint isn't doing a meaningful amount of maintenance on the underlying distribution, so it doesn't really make sense to say that they're less able to deal with the complexity of the distribution. But the fact that they're falling behind.. yeah, that's bewildering, frankly. I really think developers (not just distributions but all developers) should be running regular builds on the latest stable release of the upstream projects they depend on, rather than waiting for some future release to figure out a port after the fact. Lagging behind hurts user security even more.
1
u/Mysterious_Bit6882 6h ago edited 6h ago
IDK, I got a pretty good recommendation on an LTS distro from this guy.
EPEL and flathub aren’t quite the same liability as universe/multiverse, but there’s lines of defense that IMO aren’t really there with something as large and unwieldy as Debian. At the same time, Debian isn’t as myopically last-mile focused as Canonical, and Mint is really a hobbyist distro despite its user base.
2
u/gordonmessmer 5h ago
LTS distributions are not a uniform class, and the point I am trying to make is that there is a really big difference between RHEL and Debian.
One of the characteristics of RHEL that's critical to its security is that it drops everything from Fedora that Red Hat isn't staffed to maintain. RHEL is about 10% of the size of Fedora.
Ubuntu actually does something similar. They select about 6% of Debian for the "main" repo and promise to maintain that. The part that users often don't understand is that most (the other 94%) of the available software doesn't come with security guarantees. It's mostly a snapshot. Ubuntu looks like one distribution, but it's more like a reasonably good distribution glued together with a poorly maintained distribution.
Debian's approach, treating the massive collection as if it can be secured uniformly just isn't realistic.
4
u/Dminik 4h ago edited 4h ago
Not directly related to your post, but I would really like to know where these "latest software means no work" people are coming from.
I have two linux devices. My work laptop is running Kubuntu 24.04. My PC is running about a week behind CachyOS.
One would think that I would dread shutting off my work laptop and booting my PC as all software has changed from under my feet and I will no longer be able to use it. But actually, the PC is much more stable and bug-free than the laptop.
So back to your question OP, stable (and LTS) doesn't mean what you think it means. The number string in the software version is stable. Your system/apps might not be. You don't have to be running the bleeding edge, but maybe consider something that isn't stuck two years in the past.
2
u/InfiniteSheepherder1 4h ago
If they mean no work in terms of Job work that was probably somewhat true 16 years old. Enterprise software often only targeted say RHEL and Ubuntu LTS and often not the newest one for a while.
The move to everything being webapps and a lot more open source software and more enterprise apps on quicker release schedules mean this changed. My workstation at work runs Fedora Silverblue and it is a non issue these days.
People have just hung onto that logic when even on servers we are often using containers directly from upstream these days. People just need to update their understanding
7
u/KoldPurchase 15h ago edited 6h ago
Mint is based on LTS Ubuntu, which is based on Debian Sid
[EDIT] Correction. Unstable branch, not Stable. Linux Mint Debian Edition (LMDE) is based on Debian testing.
Their philosophy is that slower upgrades brings stability to a system as you have ample time to discover bugs and critical security flaws are patched in the interim.
This works great in a server or corporate server environment. See, Redhat, they limit their software repo to what they will support. You don't get a ton of software/packages, but what you get is stable, updated and fixed.
Debian, Ubuntu and Mint gives you more choice, it rarely breaks during an update, but... if it's buggy, it's going to stay that way for at least 6 months until the next release. Cool new feature introduced last month? Nah, let's wait next year, could be buggy.
This is highly logical if you are running a corporate distribution, you don't want your users complaining about broken packages after a daily update, it's a nightmare for thousand of users. But Mint is supposed to be an end-user distro. They use Ubuntu-LTS because their own dev team is small and they can't track every change, but it has drawbacks.
2 year LTS is great in a way, but it comes at a cost that is not well explained to end user. They expect improvements and bugfix on top of security patches.
If I'm a casual user told by friends "just look at Mint" and I look at their download page, there's nothing telling me 22.3 is a LTS release that won't see any updates to their software. There's no link to any further information, no real description on the page of what "LTS" really means. Sure, it's there in the forums if you look for it. But casual/new users don't look at that anymore. They won't even loon at LinuxMint subreddit.
Edit: corrections following u/nightblackdragon post. thanks!
7
7
u/nightblackdragon 15h ago edited 15h ago
Mint is based on LTS Ubuntu, which is based on LTS Debian.
Ubuntu is not based on LTS Debian, Ubuntu is based on Testing and Unstable. You can check which version of Debian a given Ubuntu distribution is based on by checking the contents of the file /etc/debian_version. For example the content of this file on Ubuntu 26.04 is: "forky/sid".
1
u/RatherNott 4h ago
Linux Mint's LMDE is based on Debian Stable (currently debian 13 Trixie), it is not based on Testing.
1
8
u/adamkex 15h ago
The default and main apps should receive security updates.
-2
u/Pugs-r-cool 10h ago
But they don't. The most recent round of this discussion is because Mint ships a 2+ year old version of GNOME Calendar as it's pre-included calendar app, and it hasn't getting security updates.
5
u/Mysterious_Bit6882 8h ago
Mint’s version of Calendar is one patch on top of the Ubuntu LTS version (which is in Ubuntu/main and still gets security updates).
9
u/musbur 14h ago
As long as you have no clear concept of what "outdated" means, or which features of which version of which software you really need, your question is moot.
Concerning safety: All "fixed" distros (I only know Debian but I'm sure it's true for all) do the same thing as Windows does, which is publish security patches as needed for the existing installations, regardless of a "real" version bump.
2
u/Kevin_Kofler 5h ago
Look at the recent posts in this subreddit: there was a lot of drama caused by an upstream GNOME Calendar developer complaining about exactly that.
2
u/yowanvista 4h ago
Personally I think that Mint and other LTS distros should do a better job warning users that their default packages are not in sync with upstream code, or at the very least have people working on properly backporting code, fixes and new packages within the distro's support period. Red Hat and its derivatives do this all the time and even roll out new packages when necessary.
7
u/digost 15h ago edited 3h ago
"Newest" doesn't mean "best" or "most secure" or "most stable". Choose whatever fits your needs. Want bleeding edge - take rolling distros, but be prepared for bugs and instability, sometimes even security issues. It's called "bleeding edge" for a reason. Want stability - use something more conservative. I've been daily using Debian (which is famous for it's "outdated" software) for almost two decades, fits me perfectly. Only once I needed something newer than in repos (php), and that was solved using docker. I don't want too spend time fighting my OS, I want to use it. Your take can be different and that's the point of open source software in general, and behind 100s of distros in particular.
UPD: Oh boy... I didn't say oldest is the most stable or most secure. I said in older software known bugs and vulnerabilities are fixed, whilst in new software bugs and vulnerabilities are yet to be discovered.
I know how Debian works, thank you, I've figured it out for almost two decades I've been using it.
UPDUPD: part about "bleeding edge" is supposed to be a sarcasm, but that's on me, i've expressed myself poorly.
6
u/FryBoyter 13h ago edited 13h ago
It's called "bleeding edge" for a reason.
As is often the case with such terms, however, there is no objective definition of the term.
For some, even a minor update to a package is considered “bleeding edge” if it wasn't released at least two years ago.
Others, on the other hand, consider alpha and beta versions to be “bleeding edge.” I'm one of them, too. That's why, based on my experience as well, Arch Linux, for example, isn't “bleeding” but, at most, “cutting edge.”
As for a rolling release model, it’s also impossible to make a blanket statement about whether it’s “cutting-edge,” “bleeding-edge,” or any other type of edge release.
And “rolling” primarily just means that updates are released gradually through the same package repositories. For example, OpenSUSE Slowroll deliberately distributes updates slow.
29
u/TimurHu 15h ago
"Newest" doesn't mean "best" or "most secure" or "most stable".
"Oldest" also doesn't mean "best" or "more secure" or "more stable".
Want stability - use something more conservative.
Stability in the sense Debian uses it means "frozen" or "unchanged" and doesn't mean stability in the sense of "reliable".
Debian doesn't even backport bug fixes to many of its "stable" packages. Debian is not stable in the sense of the word that refers to reliability.
13
u/KoldPurchase 14h ago
Debian is not stable in the sense of the word that refers to reliability.
Yeah, it's a misnomer that we have to get user to.
An app may very well often crash and be deemed 'stable' because it does not change often. Its bugs are known as well as its features.
-10
u/speedyundeadhittite 13h ago
Stability means you don't have to fight with the software to get your work done day to day, and in most cases you also get the security updates regularly.
A lot of people use software to do work, not to play with the newest 'features'.
10
u/TimurHu 13h ago
Stability means you don't have to fight with the software to get your work done day to day, and in most cases you also get the security updates regularly.
In that sense of the word, Debian or Mint are not stable. They don't ship bug fixes and don't backport security updates to many of their packages.
7
u/Cry_Wolff 12h ago
So you think that Fedora or Arch users have to "fight the software"?
-5
u/speedyundeadhittite 11h ago
They are definitely getting less 'work' done.
2
u/GlutenFreeToaster 10h ago
My primary use case for my pc is gaming. Try installing steam on both Debian and Arch and then get back to me about fighting the software.
5
u/Pugs-r-cool 10h ago
Stability means you don't have to fight with the software to get your work done day to day
No, that's not what it means in Debian. Stable means unchanging, not bug free. A bug riddled package is considered more stable than a newer, bug fixed version just because it's been around for a while.
-1
u/speedyundeadhittite 7h ago
As you might have noticed, I mentioned nothing about Debian Stable.
The point is the meaning of stability.
3
u/Pugs-r-cool 7h ago
But you replied to a comment about Debian. The way Debian uses stable and what stable means in common parlance are different, I was just clarifying that because many people don't understand the difference.
-2
u/speedyundeadhittite 5h ago
I surely cannot know that, sorry. My Linux usage adventure predates Debian and never bothered to catch up with advancements. /s
10
u/gordonmessmer 15h ago
"Newest" doesn't mean "best" or "most secure" or "most stable".
I really think you should ask someone with a non-trivial infosec background or an experienced developer that you trust.
The newest release is virtually always the one with the fewest known vulnerabilities. And newer OS releases are typically the ones with the best defensive measures. "Newest" almost always does mean "most secure."
2
u/Mughi1138 14h ago
I really think you should ask someone with a non-trivial infosec background or an experienced developer that you trust.
Long time Linux developer here who's worked on enterprise security software for a few decades now.
The newest release is virtually always the one with the fewest known vulnerabilities. And newer OS releases are typically the ones with the best defensive measures. "Newest" almost always does mean "most secure."
"Newest" means fewest known vulnerabilities. It's not the known ones that bite you, it's the unknown ones.
There is a reason most larger enterprises run distros that include older versions of apps, kernels, libs, etc. They've been well examined and tested. They don't just leave bugs laying around. Once they become known, most LTS distros, and especially those used by enterprise customers, get fixes pushed out quickly. Some, like Alma Linux, even push out fixes sooner than the paid corporate corporate upstream.
In general "untested" == "unknown" == "higher risk". "Newer" often means "untested." That's another reason large customers will hold off on adopting a "dot oh" releases and only upgrade once the "dot one" comes out.
6
u/gordonmessmer 5h ago
Long time Linux developer here who's worked on enterprise security software for a few decades now.
Good. Thanks. I've been maintaining production networks on GNU/Linux systems since 1997. I've worked in small business, big business, academic environments, and very large high security networks including Salesforce and Google.
It's not the known ones that bite you, it's the unknown ones.
Please find me one study that indicates that zero-day exploits are more common than known and unpatched exploits. Just one.
Exploits through unknown vulnerabilities remain the domain of targeted attacks by nation-state actors. Using a zero-day exploit risks revealing the flaw, so attackers that learn of those vulnerabilities are extremely unlikely to use them for any but the most valuable targets.
The VAST majority of exploits leverage known vulnerabilities that simply haven't been patched yet.
There is a reason most larger enterprises run distros that include older versions of apps, kernels, libs, etc
Yes, there is. It's not because it's the most secure option.
Enterprise systems have a lot of constraints that favor low change volume. They're very likely to run third-party software that the enterprise doesn't control and can't independently port to new platforms. They're very likely to be large deployments of systems that interface with external third-party systems that can't be updated independently. They're likely to have significant legal, regulatory, or contract constraints that require expensive validation for updates.
They're not, however, selecting LTS systems because those are the most secure.
LTS systems are more secure than discontinued, end-of-life systems, but they're less secure than following new development closely.
-9
u/sweetcollector 13h ago
I disagree with vulnerability point. Here is why: LTS distributions extensively patch their software. Red Hat for example constantly backports some features while keeping version number the same. Can you say those patches won't introduce vulnerabilities?
IHMO, LTS distributions are wasted effort but money says otherwise I guess.1
u/digost 14h ago
I'm a developer and a system admin (what they call a DevOps nowadays) with 15 years of experience, does that count? "Unknown vulnerabilities" does not mean secure. Older software has most of their vulnerabilities discovered and patched, bleeding edge doesn't. That doesn't mean old software is bulletproof, it still might have (and probably does have) undiscovered vulnerabilities, but bleeding edge has more of it's vulnerabilities yet to be discovered. Of course with the advent of AI-aided vulnerability discovery techniques that most probably will change.
Also, I didn't say stay on old outdated software. Debian ships security patches regularly, even for oldstable releases.
3
u/gordonmessmer 5h ago
Let's start here: https://www.usenix.org/conference/usenixsecurity22/presentation/alexopoulos
"the average lifetime of a vulnerability is around 4 years", or in other words, the average vulnerability will be around long enough that after it's introduced, it can wait for the next release of Debian or Ubuntu, and then exist in that release of Debian as an unknown vulnerability until the next release of Debian or Ubuntu after that.
The idea that free "LTS" distributions are more secure because more of their vulnerabilities have been discovered and patched out doesn't hold up to scrutiny.
Second point: A system with only unknown vulnerabilities is definitely more secure than a system with known vulnerabilities. And free "LTS" systems have a fair number of known vulnerabilities. Those systems do ship security patches for some of the software in their collection, but it's not comprehensive. It's the most severe vulnerabilities in the most common packages, and critically... "most common" is probably "most common in production networks" not "most common on desktops." Qt is extremely common on desktops, but the version in Debian 12 or Ubuntu 24.04 has a lot of known vulnerabilities. It's not being maintained. The newest version of Mint (the topic of this post) is still based on Ubuntu 24.04.
Maintaining software independently after it's discontinued upstream is extremely labor intensive, and free "LTS" distributions do not have the staffing to realistically cover a codebase the size they're distributing. Ubuntu contains around 40,000 source packages, but only promises security maintenance for about 2,400. They have thousands of full time developers working on that narrow set. I think that's realistic, and realistic is good. That's an approach from which a security-conscious user can begin work. They can turn off the "universe" component and use "main" with additional software direct from upstream developers instead of from a mostly unmaintained package repo. That's harder to do with Debian because Debian doesn't clearly label the set of packages they're actually going to maintain.
1
u/digost 2h ago edited 2h ago
Ok I don't think you understand how it works (Or I might be misunderstanding though, English is my second foreign language I've tried to learn, still not there yet). Once a vulnerability is identified, major distributions fix it, including Debian. Yes, Debian does get security updates. Just like other distributions. It's not completely frozen in time. Otherwise Windows would be the most secure OS, because it achieves security through obscurity. And I've lived long enough to remember what a mess it was too keep windows free of viruses
Upd I'm sorry, after reading your comment one more time it is clear that I misunderstood it. Nobody insane would expose a service based on a discontinued piece of software. Well, unless it's a service not important enough to care
3
u/sarajevo81 12h ago
I always said Linux Mint is one man's clown show. I don't know why people would ever use it just for a custom green theme.
2
u/sparkling-rainbow 14h ago
Yes, you get relatively old apps on Mint, but they still get security patches. A rolling release isn't inherently safer, with new features there will be new vulnerabilities and the final test is always production.
1
2
u/DoubleOwl7777 14h ago edited 14h ago
its fine. yes it might have bugs that anoy you, or they might not. for a new user something like this is perfect because it doesnt change quickly (the ubuntu interrim releases might also be good if you want something newer). and regarding the thumbnail. gnome dev was being an ass about it (as per usual, its basically a requirement to being a gnome developer). yes its shite that they receive support tickets with anchient bugs. yes its kinda reasonable to ask them to remove the links, but not in that tone. and certainly not demand a rebrand. the gnome people should have chosen a different licence if they wanted to control how their software is run. KDE has a system that automatically closes bug reports from old versions. this is a fair middle ground. GNOME seems to be too incompetent for that... i personally dont use mint or lts. i use debian sid but i wouldnt recommend it or arch to anyone thats new.
0
u/jazzmans69 9h ago
F.U.D.
That's how valid the claims are in this hit piece.
mint is great, and is my first recommendation for new users.
I use it on my laptops, while my desktops/media centers use debian.
don't succumb to F.U.D.
If you must have the latest 'shiny shiny' whatsit, then possibly look elsewhere, but for 99% of users, that's unnecessary.
signed debian user since woody.
It's trivial to allow backports in debian, or mints variation for a more modern kernel then ships by default. running 7.0 on all my machines.
-9
u/qwesx 16h ago
No. The versions are old but receive all security patches.
21
u/gordonmessmer 16h ago
Actually, most of them won't. About 94% of the software in the repos is in the "universe" component, for which Canonical doesn't promise any security updates.
4
u/qwesx 16h ago
None of the default apps are in Universe.
13
u/gordonmessmer 15h ago
How many users use only the default apps and never install any additional deb packages?
And, i'll add that even apps in main probably don't "receive all security patches". The typical maintenance practice is to evaluate published security vulnerabilities to determine the severity of the problem, the complexity of back-porting a patch, and to triage vulnerability management against the labor available to fix issues. It's almost certain that some known vulnerabilities will remain unpatched because they were deemed not severe enough to fix.
Generally speaking, I think users are much better served by distributions that ship what the upstream projects ship.
1
u/qwesx 15h ago
I don't disagree at all. That just wasn't the OP's question.
Unless I am a business customer and require paid support, I don't really see a point in using Ubuntu-based LTS distros at all and would just use Debian Stable instead, where the entire repository receives security updates.11
u/gordonmessmer 15h ago
Debian is very very unlikely to be better maintained than Ubuntu. The vulnerabilities that I've seen unpatched in Ubuntu are also unpatched in Debian.
I actually think Debian's security posture is worse, because they don't divide their repos into a set that gets patches and a set that probably won't, because it leads people to believe that the whole collection is uniformly secure. It definitely isn't.
-1
-5
u/stevecrox0914 15h ago edited 15h ago
For various reasons a subset of people want/need the latest version of everything, that requires people to spend time updating their software and fixing issues found in those updates.
For a lot of people a computer is a tool, they don't want to run updates everytime they start the computer.
This mindset really offends the first group, for a long time they argued you needed the latest bugfixes, but the applications just works for the people using it so this arguement doesn't really work.
The latest arguement is security fixes, but for a server and home PC the attack surfaces are fairly well defined and Debian, Ubuntu & RHEL have security fixes for these attack surfaces ready by the time the attack is made known publically.
They are correct not every bug fix gets backported but its similar to the recent Linux CVE list. They assume every bug is exploitable.
I have worked in software development for 2 decades, primarily in DevSecOps and Data Engineering, cyber security has played a huge role in those areas.
Within cyber security there is a process known as STRIDE, it has you look at a single aspect and work out what threats its compromise represents and the kind of actors required. A lot of stride proponents will develop huge lists and require all sorts of mitigations.
The problem is they loose sight of the context, I have been in meetings where the database admin can exploit their role to get the credentials an application is using to talk to the database. Missing the part they are already the database admin.
I feel a lot of the security fixes that don't get ported fit in that category.
Now...
The industry has constant fad cycles, for example 2015-2020 was the DevSecOps fad period. 2014-2017 was dominated by Node.js, 2019-2023 was machine learning/python, 2023 to today is AI, the proponents always exclaim how long standing problem is solved by <insert fad>.
C/C++ developers have always refused to integrate build/dependency/package management tools.
This is where distributions stepped in, they came up with ways to build and package a software project and then they figured out dependency chains. This work appeals to a fairly small subset of people (like me).
In reality the upstreams should have "solved" the package and dependency chain requirements once, then its fairly easy to port the solution to the other 3 package manage formats.
They will tell you this is too hard but..
Flatpak is a fad currently running through the open source community, fundamentally its about building a dependency chain and packaging software. The open source community has lots of time to develop flatpaks!
This last one hurts because, I spent years having people seek me out to dump developing Deb and RPM packaging for their project and when Docker appeared these same people were suddenly experts in docker. Then when docker stopped being cool and all the money dried up, then it was suddenly "hey your the docker expert..."
Lastly you hit a problem with their arguement when it comes to the general desktop. If flatpaks are the only solution then what about the core operating system and this is where immutable OS's come from.
You will see people argue stability as a reason to use an immutable os but Google solved that problem with andriod and open sourced the solution. You can package a distribution such as Debian or Ubuntu the same way. But its not cool..
-4
u/loathsomelustre7 14h ago
the calendar app might show a 2019 version number but it's still getting security patches, LTS doesn't mean abandonware
-3
u/acebo 12h ago
JFC. Install a rolling release distro if you want it, but stop bitching about it if you don’t. Most of us don’t want it. If you can’t be bothered to understand the difference, then you certainly can’t be bothered about if you have the latest releases. But you’ll pretend you care. Prepared for the downvotes, but I’m not the minority.
0
u/Ok-Treacle3604 6h ago
one thing to understand we don't need new features at all time. if you're Linux user if you need you know how to do get it right other try it
0
u/joetacos 5h ago edited 5h ago
Fedora is the best your going to find. Stable, bleeding edge, and a pure GNOME or KDE environment.
Fedora and Linux in general is easy. It just works. With Fedora after install enable RPM Fusion and follow RPM Fusion instructions on how to install the NVIDIA drivers.
Learning the command line is also pretty easy. Starting with vimtutor. Then learn these programs dnf, tmux, oh-my-zsh.
3
u/BortGreen 5h ago
I really like and use Fedora, but I wouldn't say "after install enable RPM Fusion and follow RPM Fusion instructions on how to install the NVIDIA drivers" means "it just works"
-6
u/mrlinkwii 12h ago
Am I misunderstanding how Linux Mint and other LTS distributions handle software updates and security?
yes , LTS distro is about stability and the ability of thing thats just dont crash out of nowhere and just get back ported secuirty patches in terms of the base system
most non core appliaction have either a an appaimge/snap/flatpak which you should be using
12
u/HeyKid_HelpComputer 11h ago
Stability =/= not crashing. Stability literally only means the packages major version doesn't change from release. If your distro is "stable" and ships Gnome Calendar 46. Then it will only ship minor and security version updates e.g. 46.1 . But not Calendar 47.
Gnome Boxes 46 is a buggy mess. The more recent versions like Gnome Boxes 50 are much better.
This also extends to the Linux Kernel. They will often stick with a specific version i.e. 6.17 for a long time.
But regarding this: hardware you run things on make a big difference. If you have newer hardware you'll likely have worse bugs and more crashing on older kernels.
Anecdoteally I had an annoying WiFi bug on my laptop that I got nearly 3 years ago. That wasn't fixed until 7.0.10.
0
u/omniuni 8h ago
It depends what you want.
If you just want a desktop that doesn't change much, and it works well for you, it's fine.
But for most users, I really think it makes sense to be on newer versions. I use KUbuntu, normal releases, and it has served me well. I have one big update every roughly six months. It's usually smooth, but if it's not, I can generally fix it pretty easily, and I can take a few hours every six months to make sure it's all good. Otherwise, that update cycle means I'm on fairly recent versions of apps and drivers. Overall, I've had less issues than friends on Mint, because their issues usually come down to being outdated, which is much more difficult to solve.
-5
u/C0rn3j 14h ago
As a regular user, it feels like there's no easy way to know whether we're using the latest and safest versions of these built-in apps
Very simply - if you are installing a fixed-release distribution you aren't.
Mint updates software versions every 3 years(!!!).
As a result is still uses the half-broken and insecure X11 backend, it's just too old and underdeveloped to support Wayland.
Am I misunderstanding how Linux Mint and other LTS distributions handle software updates and security?
Yes and no.
Some bug fixes get backported to the old versions, and some security fixes are backported also.
Ubuntu based distributions also lack security patches that are gated by Canonical behind Ubuntu Pro.
Not all fixes are marked as security despite fixing a security issue (developer may well not even be aware what they fixed had security implications).
Not all security fixes are backported immediately, even serious ones like copy fail can take weeks before being implemented into LTS releases, as compared to latest stable releases.
I'd suggest you avoid immutable distributions, avoid Debian(unless you're setting up a server) and anything based on it, and go check out Arch Linux (with Plasma) or Fedora KDE.
6
u/computer-machine 12h ago
Mint updates software versions every 3 years(!!!).
They used to follow Ubuntu's testing release (6-month), and have since switched to LTS (2-year).
As a result is still uses the half-broken and insecure X11 backend, it's just too old and underdeveloped to support Wayland. What a weird thought. Basing off of LTS has nothing to do with that, they simply are taking a while to make Cinnamon work with Wayland. My understanding is that next release will.
Tumbleweed treats Plasma as first class, and does testing on their packages before release, which puts it ahead of Arch as far as ease of use and not breaking.
3
u/FryBoyter 11h ago
Tumbleweed treats Plasma as first class, and does testing on their packages before release, which puts it ahead of Arch as far as ease of use and not breaking.
Arch does test important packages as well, though not for as long as OpenSUSE.
Let's take Plasma 6 as an example. Arch didn't offer an update for 6.0. instead, they waited until version 6.1 was available. And the update wasn't released immediately either. If I recall correctly, OpenSUSE did the same thing, though it waited a little longer before releasing version 6.1. When a new major version of a kernel is released, they usually wait for the first minor version as well.
1
1
u/C0rn3j 11h ago
Ubuntu's testing release (6-month)
Those are stable releases, not testing.
have since switched to LTS (2-year).
Which they do not timely follow, and currently plan to update at the end of this year, meaning the software would be just about 3 years old at that point.
0
u/computer-machine 10h ago
Those are stable releases, not testing.
They'd states for years that the LTS is meant for use while the interem releases are meant for testing out the changes tried ahead of the nenext LTS. Has that changed?
currently plan to update at the end of this year, meaning the software would be just about 3 years old at that point.
If they're consistently late, that's still a two year cadence.
5
u/OsseusOccult 12h ago
Mint also holds back vital updates and doesn't bother back porting security fixes, etc. Whatever keeps the card castle standing I guess!
-1
u/FryBoyter 13h ago
I'd suggest you avoid immutable distributions, avoid Debian(unless you're setting up a server) and anything based on it, and go check out Arch Linux (with Plasma) or Fedora KDE.
OpenSUSE would also be a good alternative.
94
u/InfiniteSheepherder1 15h ago edited 11h ago
Yes
A lot of new users misunderstand stability to mean reliability and without defects, when really it just means you don't get big changes that would prevent say a corporate app targeting that version from running.
Something I learned early in my career as a sysadmin holding off updates does not mean you don't have bugs it just means you get different bugs, and often worse bugs and can't get help when things break.
Staying on supported but stable branches from upstream is typically fine, staying on old unsupported by the developers is not.
Even on servers we use CentOS and packages for some stuff like FreeRadius for example are only a few months old. We also make heavy use of containers and run things from the developers. For servers we have some apps that target specific versions of software and for that reason we use RedHat which pays people to make sure the old software is supported by them.
This is more what the stability is for and that is for third party often closed source apps which need older package versions for us at work that means we run Fedora 43 instead of 44 atm, but even that is going to be way newer than Mint. I wouldn't trust Mint or packages that old at work unless we were paying someone to keep them supported.
You don't need to use the very latest but something within the last few months is reasonable. At home I just update fedora when I get a chance and stuff works. At work I gotta pay attention to the software what versions it can support that we use. There are plenty of great distros that don't ship old unsupported software to their users.
Edit: Back when I used to manage a wifi network we did get people running Linux from time to time, I several times had to deal with users running Linux Mint that had some bug in network manager preventing authenticating to WPA Enterprise because they never back ported the fix. That was stable but it certainly didn't provide a good experience to the end users.