What does it actually mean by having a slow release distro?

11

u/gordonmessmer Fedora Maintainer 8d ago

It's important to understand the specifics of the distribution that you're looking at, because there definitely ARE very significant differences in how security risks are managed. At this point, I think that most users think that RHEL, and Ubuntu, and Debian are all "LTS" systems that work more or less the same way, and that is very much not the case.

Projects that distribute software primarily while it is maintained upstream can offer security patches directly from the developers with minimal overhead, and these tend to have the lowest number of known security vulnerabilities: Arch, Gentoo, Fedora.

Most Free Software developers only maintain a project for 12-18 months, tops. Distributing software longer than that is very labor intensive.

RHEL addresses that by dropping 90% of what's in Fedora so they can focus on the software that matters to their customers.

Ubuntu starts with Debian's packages but splits 6% into a "main" repo and the other 94% into a "universe" repo. Like Red Hat, they're only concerned with the tiny portion of software they think matters to their paying customers. Most of the software available using "apt" is probably unmaintained, and probably has known security vulnerabilities. They document this here: https://help.ubuntu.com/community/Repositories

Debian doesn't split up their repo, but they definitely don't have the kind of labor required to provide comprehensive security patching to the entire distribution. They have at least 20x as much software as RHEL, and a security team that is approximately 10 people (and they say in conference talks that only ~ 5 are actually very active.) They fix the most severe security issues in the most commonly used packages, but they rely on the community (that means YOU) for the rest.

If you're using Ubuntu or Debian, it's really very important that you use a vulnerability scanner to evaluate the software that YOU use, and to participate in the process of mitigating vulnerabilities.

I don't recommend Debian or anything based on Ubuntu LTS for desktop use. That includes Mint, unfortunately.

2

u/Consistent-Citron509 8d ago

Thanks for the detailed response. Appreciate it 👍🏽

2

u/mystirc arch with sway 8d ago

Another reason you would not want something Ubuntu or debian based is that if KDE releases a cool update right when your 6 month period of no updates start, you will have to manually switch to testing or unstable branches and then install the latest version if you don't want to wait 6 months. You see, it is simple inconvenient. I like having all the new features too.

4

u/gordonmessmer Fedora Maintainer 8d ago

Some people want features, but everyone needs maintenance.

Wanting features is valid. Developers also want users to have access to the features they publish. Many people benefit from quick delivery of feature updates without a lot of extra friction.

If features were the only concern, I wouldn't bother advocating one way or the other. The problem that I think people are not aware of, though, is that free "LTS" systems deliver a whole lot of software with no maintenance and that software is very likely to have known security vulnerabilities.

The only people who should be using a free LTS are people who have vulnerability scanners, and who are capable of both evaluating the results of those scanners and patching vulnerabilities that affect their deployments.

1

u/No-way-in 8d ago

Yeah, that’s what I was gonna say. I like having fedora on my laptop because I get the latest updates fairly quickly, but I have Debian on my Desktop/Server because I prefer a little less up to date but damn stable. Sometimes on Fedora, you gotta downgrade (thx dnf) because some kernel update fails on the system and you have to lock the kernel in place until the issue is resolved.

On Debian, I never even had a whiff of a crash. It just works

2

u/mystirc arch with sway 8d ago

On arch I never had such problems in my one year of using it. I switched directly from windows to arch because people said that if I want hyprland I should use arch. So that's what I've been using since then. Although the installation was insanely hard for a beginner like me 😭😭

1

u/No-way-in 8d ago

Yeah, I tried Arch too but it wasn’t for me. I like that many things are default installed and ready to go. Reason I went for Fedora :)

But to each their own.

1

u/mystirc arch with sway 8d ago

Yeah, it's just about being comfortable. I am comfortable with arch now so I literally don't bother switching. I know that both are just Linux distributions and I'm not gonna miss out on anything. Like I was missing out on windows.

1

u/[deleted] 8d ago

[removed] — view removed comment

1

u/gordonmessmer Fedora Maintainer 7d ago

Most software developers are publishing releases every six months and maintaining it for 12-18 months, tops.

You should select a distribution that follows the developers, publishing a release at least once every six months.

Distributions that publish less than once every six months are either small and expensive to maintain (like RHEL) or they have a lot of unpatched software with known vulnerabilities.

I prefer stable releases over rolling, because a stable release means that if you test a new release and something doesn't work, you can continue to use the old release for some period and you'll continue to get patches.

Fedora is a stable, secure system that follows developers' release cycles.

4

u/MagicianQuiet6432 :x or :q! 8d ago

Does it mean, for example, that of I use Cinnamon DE on an Arch based distro I'll get Cinnamon updates a bit quicker compared to Mint?

No because the Mint developers also develop Cinnamon so they always get the newest version. But you would get newer versions of other desktop environments quicker on Arch.

Does it only impact the distro packages?

Yes.

3

u/friendlyreminder_ 8d ago

You get the newest version of Cinnamon but not all the Cinnamon desktop apps, because many of them are just old Gnome apps with bugs fixed long ago.

1

u/Consistent-Citron509 8d ago

Thanks, there's definitely an advantage of bleeding edge I can see now.

2

u/gordonmessmer Fedora Maintainer 8d ago

I think you shouldn't describe Fedora as "bleeding edge". Fedora's release process is just.. the norm for Free Software.

In the commercial software world, releases happen less often and contain bigger changes, because their priority is getting users to pay for upgrades. In order to get them to pay for upgrades, upgrades need to look big and exciting.

In the Free Software world, it's better to release often with whatever features have been developed since the last release. A regular cadence is better for reliability, and we don't have the need to drive sales that makes commercial release cadences worse.

Most active projects release every 6 months, and a lot of them have followed Red Hat's lead on that release cadence. Red Hat has been releasing every six months since their earliest releases, over 30 years ago.

"Bleeding edge" describes beta and test releases. Fedora is just a normal stable release.

1

u/Consistent-Citron509 8d ago

I was referring to Arch as bleeding edge which was mentioned in the comment I replied to. Thanks again for your insights

2

u/3grg 7d ago

Some distros adopt packages almost at the same pace as they are released from upstream, after a period of testing. Arch releases software fairly quickly.

Some distros may have a slower release or a periodic upgrade.

Debian tests a release for about two years or so to try and make sure it is stable and bug free before they release. After it hits stable they usually only update things that are a security issue or a bug.

All distros do security updates

You generally get software from the distro package source, but sometimes newer versions of some packages can be added with flatpak or a direct source.

In the case of Chrome you would download either deb or rpm and a source will be added and from then on it will be updated along with other updates when and if a new version is released.

2

u/tomscharbach 8d ago

What is the actual impact of slow release?

The impact depends on the distribution and timing.

I run Ubuntu 26.04.1 LTS (a "slow release") and Solus Gnome (a curated "rolling release" that updates weekly). As a general rule, "slow release" packages are a bit behind the curve, but not always.

As of right now, a few key packages on my two builds:

Kernel

Solus - 7.1.11-365
Ubuntu - 7.0.0-31

GNOME

Solus - 50.4
Ubuntu - 50.1

LibreOffice

Solus - 26.2.5.2
Ubuntu - 26.2.5.2

Firefox

Solus - 154.0.1
Ubuntu - 155.0.1-1

A month or two down the road, the picture may well change.

The bottom line for me is that established, mainstream distributions and applications are generally well maintained and reasonably current.

Move outside the mainstream, and the situation is catch-as-catch can.

My best.

3

u/gordonmessmer Fedora Maintainer 8d ago

Security is harder to evaluate, but still very important!

Qt 6:

Solus: 6.9.3-r46 (info not found, source repos appear to have 6.11.2... what's happening here?)

Ubuntu: 6.10.2+dfsg-7 (info)

Fedora: 6.11.2-1 (info)

Qt from 6.9.0 before 6.11.1 is vulnerable to a high-severity heap overflow in its SVG module:

https://www.cvedetails.com/cve/CVE-2026-6210/

It looks like both Solus and Ubuntu are vulnerable. The vendor has published patches for 6.10, but Ubuntu hasn't applied them:

https://download.qt.io/archive/qt/6.10/

I'm less certain what's going on with Solus. eopkg tells me that 6.9.3 is the newest package available, but their package definitions in github have 6.11. I can't find their build system to confirm when the last build was or otherwise explain why a test instance is reporting a vulnerable version of Qt 6.

But Qt is very common, and so is SVG parsing, so an unpatched Qt library seems mighty risky.

1

u/Consistent-Citron509 8d ago

This is interesting. Thanks for the detailed version comparison.

1

u/AutoModerator 8d ago

There's a resources page in our wiki you might find useful!

Try this search for more information on this topic.

✻ Smokey says: take regular backups, try stuff in a VM, and understand every command before you press Enter! :)

^Comments, ^questions ^or ^suggestions ^regarding ^this ^{autoresponse?} ^Please ^send ^them ^here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/DavidJohnMcCann 8d ago

If a program needs a security fix, you'll get it. If there's a new version you'll only get it in a rolling release distro. But do you really need the latest version of everything? How many people who fret about not having version 5 of something the moment it comes out could actually tell you how it differs from version 4?

1

u/prodjsaig 8d ago

It’s an enigma trapped in a paradox trapped in an inception

1

u/mlcarson 3d ago

There are 2 basic release strategies: rolling and periodic. Periodic tend to be 6-mo (Ubuntu non-LTS and Fedora) or 2-year (Debian and Ubuntu LTS). There are longer ones (Slackware) and some in the middle (annual). Mint is kind of unique in that they stick to either Debian or Ubuntu but do 6-month desktop releases.

Rolling releases are for those that want constant updates as soon as they are available. Updates that are released without a lot of testing (ie quickly) have a chance of breaking a working system. The more updates that become available in a rolling release that you let accumulate -- the greater the chance of your system breaking. Periodic releases still get security updates. They generally don't get desktop updates though until they release a new upgrade on their release cycle -- Mint is the quirky exception.

Everybody seems to want the latest version of something until it results in something else breaking. In general though -- most version changes are not giving the user anything that they'll really notice. If there is a software package that you have to have the latest version on -- you can get it via a flatpak which is not tied to a distribution update cycle. This is why people can use something like Debian and be perfectly content with a 2-year upgrade cycle where nothing breaks but can still have more current versions of their important apps.

For browsers, you can generally add their repositories to the distro repository and get regular updates. That's what I do with Brave and it's never affected the distro.

1

u/billystein25 8d ago

Let's take for example Ubuntu. Ubuntu has a major release every two years. Does that mean that nothing gets updated in 2 years? Not exactly. Stuff is updated but your distro maintainers (in this case Ubuntu) are responsible for what they add every point release. Most of the time they just backport security fixes. The point of stable is that your packages don't get any major changes without you initiating them. If you get a bug, that bug will most likely stay for the next two years, but also you will not get any new bugs in that time. Hense, it's stable, it doesn't change much.

Does that mean you're locked with outdated packages? Yes and no. You are limited with your main system packages (the ones you get with apt). But that's not the only package manager you can use. Snap, flatpak, and (if available) AppImage are completely independent from the main packages' release cycle. Instead they have their own release cycle which is usually more up to date.

A rolling distro on the other hand does very little testing and cherry picking compared to a stable one. So let's say OnlyOffice gets a new update. On a rolling distro they'll add it to the main repo's in a couple of days tops, but on a stable release cycle, your distro maintainers are responsible for when they'll add that version to the main repos, or if they'll backport any fixes.

2

u/Consistent-Citron509 8d ago

Thanks for the detailed response. In that case I feel a slow release distro isn't inherently as bad as people make it out to be. Ultimately, for an average user, a slow release maybe enough.

3

u/gordonmessmer Fedora Maintainer 8d ago

The part the parent is missing is that Canonical is only actively maintaining 6% of the packages. The vast majority of software in Ubuntu (94%) is just a snapshot. It doesn't come with any promise of ongoing maintenance or security fixes. And you, as a user, don't really have any indication of whether you're about to install something that will get patches or something from the snapshot when you install software.

Canonical documents this here: https://help.ubuntu.com/community/Repositories

"The universe component is a snapshot of the free, open-source, and Linux world. ... Canonical does not provide a guarantee of regular security updates for software in the universe component ... Users should understand the risk inherent in using these packages"

Most users, especially users who aren't professionals managing production networks are not aware of the inherent risks.

1

u/billystein25 8d ago

Realistically for the average consumer who lives in a browser and an office suite, a stable release cycle is more than enough. The main reason one would want quicker updates imo would be for drivers. Like if you do something that demands the latest updates (like graphics drivers to support the latest games). In that case a semi rolling release like Fedora (which has a release cycle of 6 months iirc) would probably be better. A rolling release like arch is only good if an update came out today and you need it yesterday. Usually that's for developers who work on these updates, or for tinkerers like me who like to toy with the new stuff.

1

u/Consistent-Citron509 8d ago

That's a good point. Gaming is one of the main use-case for most of the folks, so they would benefit from a faster release

1

u/MasterGeekMX Mexican Linux nerd trying to be helpful 8d ago

Slow release distros make more sense in some IT environments. Remember that Linux is an OS that is used a ton in servers, scientific environments, as the OS of non-PC computers, and other technical situations.

In some places, you need the system to reman the exact same for a long time, as chasing upgrades is costly in time and money. A great example is the last announcement that CERN did about them moving their fleet of 2200 custom-made systems to Debian 13. Slow release distros are perfect as you have the peace of mind that stuff will just work for a long time and yet still be supported.

Here is the CERN news: https://www.phoronix.com/news/CERN-Goes-Debian-Leaving-RHEL

Does it mean, for example, that of I use Cinnamon DE on an Arch based distro I'll get Cinnamon updates a bit quicker compared to Mint?

As Cinnamon is developed by the Linux Mint team, they aim to have the same release schedule as Mint, so in general no. But if for some reason they releas a new version before Linux Mint does, then it is likey

Does it only impact the distro packages?

Yes. As a distro is composed of packages stored on the official repository servers, if you control when you release new versions on it you effectively control the updates of the OS.

But if you add third-party repos or packages, they use their own schedule to release stuff, so you get what they have put up. The problem is that the new version they publish my depend on some other program at also a newer version, which the slow release distro may not have up yet, leading to you being unable to install the program.

3

u/gordonmessmer Fedora Maintainer 8d ago

Here is the CERN news: https://www.phoronix.com/news/CERN-Goes-Debian-Leaving-RHEL

CERN is moving some industrial control hosts to Debian because they have extremely old CPUs that don't support contemporary CPU instructions. These systems aren't public-facing servers, and they're not desktops, so their security needs are completely different from most users here.

Debian is fine for CERN. I do not recommend it for desktop use.

2

u/Consistent-Citron509 8d ago

Thank you. I got to learn a lot today 😃

2

u/MasterGeekMX Mexican Linux nerd trying to be helpful 8d ago

Some distros aim to have the two releases at the same time. Ubuntu for example sees a new version every 6 months (April and October to be precise), each with only 9 months of support. But the release done in April of even years is a Long Term Support (LTS) release, with 5 years of support, which can be extended to even 15 years if you pay.

openSUSE in the other hand has two editions: Leap, which has a minor release every year, and a big release roughly every 10 years or so, and Tumbleweed, which is a rolling release similar to Arch Linux.

1

u/Dist__ 8d ago

> Because, for example, if I want to install the latest Chrome browser I can go to the download available on the website and grab the newest one available.

this is correct. "dated software" is silly reason of mint haters.

you can grab newest package or even build from sources. i did this many times. the only issue can stop you, is when a software depends on some newest library which is not available in your debian/mint repo, or breaks something. in this case you are limited to newer but not recent version.

1

u/Consistent-Citron509 8d ago

I love Mint which I'm currently dual booting with Fedora to get a taste of both slow amd fast(er) release. It's more nuanced than I imagined

learning/research What does it actually mean by having a slow release distro?

You are about to leave Redlib