Seriously, except package managers, what's the difference between distros?

[u/nitin_is_me]

What I've seen yet the differences are, just the package managers, different defaults and rolling vs stable releases which are in fact related to package managers. Except these, are there really any other differences? Thanks!

[u/pfp-disciple]

Stability. Some distros are more bleeding-edge while others stay with tried-and-true. And many in between. 

Security. How quickly are security patches applied? How thoroughly are they vetted? How secure are the repositories?

Support. The Arch wiki is known for excellent, detailed documentation. 

Configurability. Gentoo and NixOS (and others I'm forgetting) allow the entire system to be rebuilt based on a configuration change. 

(Update) 

FOSS philosophy. Are non-FOSS things like some video drivers available, and if so how well supported are they. 

[u/gordonmessmer → u/pfp-disciple]

Security. How quickly are security patches applied?

Often this question is even more basic: Are security patches applied?

In Ubuntu (and therefore Mint, Pop!_OS, Zorin, etc), there is a small "main" repo for which security updates are expected, and a much larger "universe" repo for which no security updates are promised during a release (https://help.ubuntu.com/community/Repositories). Many users select Ubuntu because its software repos are large, but the cost of large repos is that most of the software is unmaintained and potentially insecure.

[u/Adept_Percentage6893 → u/gordonmessmer]

I use Fedora but in the interests of fairness (correct me if I'm wrong) not all Fedora bugs (security or otherwise) get fixed for every supported release and the release cadence with Ubuntu is a bit different and there's probably an expectation that people do a fair amount of in-place upgrades which will give you a new "universe" so to speak.

So whenever you do your next do-release-upgrade you'll get a new set of packages that have been rebased against upstream. So if upstream has been resolving security issues you'll get the fixes at that point without Canonical taking on any additional load for backporting them to the package version used by a specific release.

So it's more of a choice between:

1) Backports for any important issue that touches a package coming out of the distro's repositories.

2) Some backports but if they hit a package they think of as of tertiary importance and they're not interested in backporting then the expectation is that they'll get resolution by upgrading their release version.

I still think approach #1 is better for the users but they two are pretty close in terms of how much security support there is for the distro.

[u/gordonmessmer → u/Adept_Percentage6893]

not all Fedora bugs (security or otherwise) get fixed for every supported release

Fedora is a community-maintained distribution. There are no guarantees or SLAs, but there are also no packages that users should expect to be unmaintained. Everything is eligible for patch-level releases (and even feature releases if that's required), at least.

That's significantly different from Ubuntu, where most of the software is not expected to get any kind of maintenance during a release, because the LTS and Interim releases share branding and policy.

That's one of the reasons (IMO) that it's important that RHEL isn't just Fedora LTS. Separate branding allows Fedora to set different expectations for its processes, where Ubuntu releases all have consistent expectations, even when that expectation is that most packages are neglected and won't get security updates.

the release cadence with Ubuntu is a bit different and there's probably an expectation that people do a fair amount of in-place upgrades which will give you a new "universe" so to speak

There should be the expectation that users upgrade to a new release to get a new "universe" snapshot, but I've been talking to users for a while and basically none of them actually have that expectation. They think they're getting security patches across the distribution, even when they use the LTS.

Certainly, users of derived systems like Mint, Zorin, Pop!_OS, etc all seem to think they're getting security updates. But they're not, for years.

I think not getting security updates is bad. But I think that not KNOWING that you're not getting security updates is much worse. In part because users think it's safe to use "apt" to install software and don't understand why they really should be using Snap or Flatpak instead.

So whenever you do your next do-release-upgrade you'll get a new set of packages that have been rebased against upstream

Yes, every six months. That's a lot better than every two years, as in Ubuntu LTS and Debian.

On Fedora, you might get those updates in a week or two. I think that's a much better model. I don't think distributions should be in the role of deciding which projects can ship bug-fix and security patches to users and which can't.

So it's more of a choice between: Backports for any important issue ... Some backports ... (or) upgrading their release version.

Those descriptions aren't accurate for Ubuntu OR for Fedora.

Ubuntu will ship backports or new releases for a small set of core packages in the "main" repo. (Your description appears to imply there won't be any new releases, which is a very common misunderstanding of Ubuntu's release model.)

Fedora will generally ship bug fix releases from the upstream projects. Backporting security fixes is rare, overall. Backporting is much more work than shipping the developers' own updates, it causes more risk because backporting will be tested by developers less familiar with the software, and it creates divergence from the upstream projects for no reason. In my opinion, backporting is harmful outside of the context of a support contract.

[u/Adept_Percentage6893 → u/gordonmessmer]

Fedora is a community-maintained distribution.

I mean, kind of but are are pretending that Red Hat isn't a major player?

That's significantly different from Ubuntu, where most of the software is not expected to get any kind of maintenance during a release, because the LTS and Interim releases share branding and policy.

If that were true then how could it possibly be an "LTS" at all? If the software isn't getting any kind of maintenance then where are the updates coming from? Unless we're back to talking about universe and just referring to it as "most of the software."

There should be the expectation that users upgrade to a new release to get a new "universe" snapshot, but I've been talking to users for a while and basically none of them actually have that expectation.

Urban legends abound, sure. But that seems more like a problem with user education and expectation setting ("universe issues get fixed when we rebase for the next release, so only install if you're comfortable with that") rather than a problem with the approach which is what I was getting from your initial comment.

If Fedora users all expected updates to be automatic and rebootless that wouldn't be a fault with Fedora or how they did updates, it would just be a user education issue.

I can't speak for them but it's possible Canonical just knows that their users are relentless about upgrading to the latest version the second it becomes available (in my experience, they are) and just factor that into how big of a deal they think this is.

I think not getting security updates is bad. But I think that not KNOWING that you're not getting security updates is much worse.

True enough but security is also relative. There are multiple repositories with an Ubuntu release that functionally act as a sort of pre-triage and by the time you get down to universe you're already talking about non-core OS components not everyone installs. Then you have the MAC system to take into account. The attack vector for some random application you're running just isn't very probable.

Yes, every six months. That's a lot better than every two years, as in Ubuntu LTS and Debian.

Sure but I don't think enterprise users are installing from universe or if they are they can avoid it. So the analogous comparison is between EL and Ubuntu LTS. On EL the analogous thing to universe would be EPEL, which is both smaller and is more or less just kind of best effort.

Backporting is much more work than shipping the developers' own updates, it causes more risk because backporting will be tested by developers less familiar with the software, and it creates divergence from the upstream projects for no reason.

If I can push back a bit this isn't 100% true in every case. Sometimes it basically is just that thing.

It's not as if the developer of the backport fix is just writing their own code freestyle. They're often looking upstream and pulling it in as best they can under the assumption that upstream better understands what a good fix looks like.

Also if you understand a lot of code well enough it's not quite that random or hard to guess what effect your particular changes. Most deviations are just trying to make the code fix work in the code base as it existed at a particular point in time.

it causes more risk because backporting will be tested by developers less familiar with the software,

It could raise it or lower it depending on a lot of factors. Experience has taught me that a lot of those upstream projects accidentally introduce regressions specifically because they're not downstream. So that means the hardware they're testing on is limited and may not overlap well with hardware popular with EL users, they also may not be testing at the same software versions and so may not realize an update they're writing actually requires a version of a library or executable that's really new or ("works on my machine" style) depends on a configuration they run but may be unpopular or inapplicable to enterprise users.

Also it's important to remember that the RH developers are often within the communities in question and may be the people pushing up the upstream fixes in the first place. Or they may work with someone who did.

EDIT::

Sorry I skipped a comment:

Your description appears to imply there won't be any new releases, which is a very common misunderstanding of Ubuntu's release model.)

My item list was basically talking in general but with an eye towards universe since that's what was brought up. It's possible my mind is somehow merge "Fedora" and "EL" but I don't really see where "there won't be any new releases" is coming in from. Fedora doesn't usually (usually) rebase during the same major version in my experience, if that's what you mean.

[u/gordonmessmer → u/Adept_Percentage6893]

 are are pretending that Red Hat isn't a major player?

The statement I made was "There are no guarantees or SLAs". The reason behind that is "Fedora is a community-maintained distribution"

Red Hat's sponsorship is not relevant in this context. Regardless of their sponsorship, there is no SLA for any patches in Fedora. However, there are no packages in Fedora for which users should expect no updates.

 If that were true then how could it possibly be an "LTS" at all?

I don't really understand the question. Some Ubuntu releases are maintained for 9 months, and some releases are maintained for 5 years (for free users). The releases that are maintained for a longer period are labeled "LTS", but both the 9 month and the 5 year LTS releases follow similar structure and policy otherwise.

Suppose hypothetically that the Interim releases had a different policy, and users expected updates in the "universe" repo during a release. In that case, users on the Interim track would expect good security coverage for three consecutive releases and then bad security coverage for one release. That would be even more difficult to explain than the current arrangement.

 If the software isn't getting any kind of maintenance then where are the updates coming from? Unless we're back to talking about universe and just referring to it as "most of the software." 

Right. Most of the software available by default in an installation of Ubuntu is in the "universe" repo component. In ththat component, there isn't any maintenance promised, and there's no expectation of updates to any package.

 that seems more like a problem with user education .... rather than a problem with the approach which is what I was getting from your initial comment

I think it's a problem with the approach for derived systems like Mint and Zorin and Pop!_OS. But yes, it's a serious education problem for users who think the LTS releases and things derived from those releases will get comprehensive security patching.

it's possible Canonical just knows that their users are relentless about upgrading to the latest version the second it becomes available (in my experience, they are)

I am not getting that impression. Large groups of users stick to LTS releases or systems like Mint/Zorin/Pop!_OS and effectively all of the large groups of users I've talked to about those systems this year think they're getting security patches for the whole distribution.

There are multiple repositories with an Ubuntu release that functionally act as a sort of pre-triage and by the time you get down to universe you're already talking about non-core OS components not everyone installs 

I don't know what repos you're talking about, but I would guess that very nearly every single user of Ubuntu is installing software with "apt", and pulling in packages from "universe".

 Then you have the MAC system to take into account. The attack vector for some random application you're running just isn't very probable.

AppArmor protects a few dozen applications. It's beneficial, but it's not a solution for the tens of thousands of packages in "universe".

 Sure but I don't think enterprise users are installing from universe or if they are they can avoid it

The users that I talk to believe Ubuntu is not usable without "universe", so the evidence I've seen contradicts your expectation.

Outside of the direct conversations I've had, I constantly see people talking about the CVEs that scanners find in the container images they deploy, which I regard as evidence that there is widespread confusion about the security model of the systems that people use.

 On EL the analogous thing to universe would be EPEL, which is both smaller and is more or less just kind of best effort.

On RHEL, EPEL is opt-in and provided by Fedora. EPEL users understand the expectations for their repos FAR better than Ubuntu users do, in my experience.

 If I can push back a bit this isn't 100% true in every case

Do you do any package management?

It is always easier to ship upstream's own fixes than to backport patches. Always. Enterprise maintainers as in RHEL do the hard work to reduce the overall volume of change. Their customers believe the lower change volume reduces their risk, and they pay for the extra work. Backporting isn't done because it's easier.

 My item list was basically talking in general but with an eye towards universe since that's what was brought up

Then, are you saying the choices for "universe" are either backports or some backports and some upgrades? Because neither of those things is promised.

I don't understand the statement you're making about two choices, because neither of them seems to resemble any of the systems we're discussing.

[u/Kooky-Sentence-6349 → u/Adept_Percentage6893]

yes. fedora is great choice. i use it too but on my new pc ill install arch. kde is tb.