Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:
> Why is this CVE high priority?
> See ubuntu cvss score
That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.
I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.
Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”.
Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer.
The general advice I've been seeing the past ~8 years is "There is no reason to pick Ubuntu over Debian". I don't know who the opposite advice comes from and why anyone would pick ubuntu for a server.
15-20 years ago the running joke was that Ubuntu is a Zulu word that, roughly translated, means "I don't know how to configure Debian". Ubuntu was one of the first distros that allowed one to readily download proprietary WLAN drivers without dealing with ndiswrapper or compiling half-broken OSS implementations; for this reason it caught fire with the crowd that wanted to try Linux but was otherwise unwilling to deal with such driver shenanigans. I used it on a laptop at the time because I'd heard this and was quite impressed. This reputation for "it just works" has carried them ever since even though many distros now do largely the same thing (except for cheap, obscure, or recently-released hardware).
I took the lazy route with my most recent machine and installed Mint since I wanted to use it for light gaming. I'm going to redo it with Nix sometime soon because the value prop simply isn't there.
Enterprises love paying for support contracts. If you have one, you can demonstrate something has been accounted for. A secure software without support is worse from an audit perspective than a security disaster with proper paperwork.
Most of these people never actually involve support they paid for ever.
They can pay for Debian support! (I’m not 100% sure who they should go to, but e.g. Freexian are doing Extended LTS for Debian [1], so I suppose they could do a regular support contract as well?)
Platform support. Oracle Cloud for example only provides images[1] for Oracle Linux, RHEL, Ubuntu, and Windows Server. Anything else you have to bring your own.
The more I look at this the angrier I get. This is a CVE that Anthropic claims can get a Remote Code Execution on vulnerable systems, which includes default Ubuntu installs running any sort of Go server like Caddy. Bad enough that I shut down my personal website and self-hosted tools (sorry for any typos, my grammar checker is also down).
And this is how Ubuntu describes the vulnerability to sysadmins:
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.
Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.
Since commit 079096f103fa (“tcp/dccp: install syn_recv requests
into ehash table”), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().
A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.
IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.
How is this in any way, shape, or form acceptable two weeks after the CVE was published?
sorry for any typos, my grammar checker is also down
I assume this is unrelated to the Ubuntu situation, but how does a grammar checker go down? We've been doing offline grammar checking since computers had 64K of RAM.
Self-hosted LanguageTool server[0] with browser addon. 18 gigabytes of n-gram data plus machine learning models. You can catch tpyos on 64K of RAM, but not any deep grammar mistakes, un-idiomatic phrases, or mistakes in common proper names.
It had issues all the time, and finding solutions required searching online, manually. Time consuming, difficult process. Very un-beginner-friendly.
From the throve of all possible distros, one stood out. Ubuntu. Very popular. Askubuntu Forums (with coffee beans denoting ranks) was the place when, 9/10 times, the answer to your problem could be found.
So when your fedora friend cried trying to get his camera and sound working, you either found the solutions already, or asked for them and got them. Usually the former.
That was the biggest advantage of Ubuntu. Big community and wealth of troubleshooting knowledge already available. And it had the opinion of a beginner friendly system. Which made the community grow and created a large market/userbase for help threads/tutorials.
Add to that, that people are creatures of habit and 'voila - you have a lot of people sticking to Ubuntu just because they never got so pissed at them that they would change their distro.
I think it's just brand, ubuntu was what I knew from using it as a personal desktop and then it's the default/most obvious option for a lot of providers, I think even 10+ years ago AWS EC2 defaulted to it above Debian, digital ocean too I think?
I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think they got reputation as being the 'just works' option because they were happier to include some non-free graphics drivers etc where Debian was the more pure option but most end users didn't care
But since they added snap and I started running into issues with trying to install Docker etc a few years ago I default to Debian now and most of the time I don't even know which it is.
> Stable Debian is using Linux 6.12, if your laptop has modern hardware what do you do? Can't use wifi?
And Ubuntu 24.04 LTS is using 6.8.
Ubuntu releases a new version every six months, but an LTS — which is probably what most people run in production — only every two years. Debian releases come out every two years.
So if you only run Ubuntu LTS, the release cadence is the same as Debian.
> I think you're forgetting about Ubuntu 26.04 (LTS) that is using kernel 7.0.
Which only came out a few months ago, and which only recently released its .1, so the do-release-upgrade message only recently appeared for most people.
I'd be interested to know how many folks have changed their current production over to 26TLS in the last six months. I'm guessing not a lot.
So yes, there is a newer LTS, but what is its current market share as compared to 24 TLS (or even 22LTS)?
Ubuntu releases its LTSes in even years, and Debian does its releases in odd years:
That, or just pick the kernel package from unstable or testing. Apt is smart enough that mixing packages from different versions of Debian works just fine.
(I mean nothing is 100% but I've been mixing packages for like 2 decades now and literally can't remember any specific trouble resulting from it.)
It's not 'as supported', sure, but I'll also note that wifi, at least, has worked on pretty much every modern laptop which I have installed Debian upon.
Debian testing is way more stable than Ubuntu stable. In Debian's parlance, Testing means "release candidate", actually.
If you want real testing, you should run "unstable". If you're in for fun, try experimental.
Running Testing on my desktops and stable on my servers since forever. None of them broke, none of them created problems.
I don't care Stable running 6.x.x. It gets security updates in less than 24h, and is applied automatically before I wake up, and doesn't ship coreutils with 104CVEs, just because it's Rust.
Debian security team used to offer support for testing, but as the distro grew and attack surface increased, that was dropped. However, security incidents are patched in unstable as well and they float up to testing relatively quickly (for a desktop system, anyway). When things freeze, security updates directly land on testing as a fixup polish.
However, while Testing is "relatively secure", it's never "Server secure". I'd never use testing or testing packages in stable or any server for that matter.
The comment you're replying to makes clear that they're not using it on servers. I do the same thing (testing on my laptop(s), stable on my servers); you just have to commit to keeping track of what's going on and manually patch if you think that it's necessary.
I have to add that for me, testing definitely breaks stuff sometimes. Nothing beyond my ability to fix, though. Nothing beyond anyone's ability now that AI is around.
Back in 2005-2008 or so, I think Ubuntu was a genuine breakthrough as a polished desktop version of Linux that set a standard that various other distros, eventually, caught up to. I think Cinnamon and other distros eventually caught up on polish.
They also had credible commitments to long term support that brought people on board. I think that was enough to get them on the map, but personally as a desktop user, I haven't used it in a while, mostly sticking to Debian and Arch.
I think you are right about the branding / reputation. Personally I heard negative things about Canonical and I heard that they just basically follow Debian, so why not use the original? It's been a great experience so far. Perhaps because Debian moved to include proprietary drivers out of the box now it is extremely easy to set up.
Here in NL as well. I attribute it to population ageing (babyboom generation), but AFAIK that issue is much less severe in USA than other countries which suffered in WWII. China is going to have the issue severe due to the one child policy. That population is going to get reduced a lot (not taking into account migration).
In my EU country, making an appointment got extra steps asking about one's mental state, namely depression or loneliness. One wonders if this age of social atomization, people (probably mostly those elderly) are making unnecessary appointments just to have someone to talk to.
Local minecraft server definitely requires port forwarding at the router... as I've learned to my chagrin that Starlink doesn't support port forwarding... Goodbye self hosted minecraft. Did it for nearly a decade and cannot anymore.
> What is Ubuntu offering that Debian doesn't provide?
Surprised how many answers here are on "social" reasons, and ignoring that Ubuntu does provide genuine additions to Debian.
Ubuntu includes additional proprietary drivers to Debian. So there are legitimate hardware cases were Ubuntu will work out the box and Debian won't. I can't speak for how many people need those drivers, and how much of choice is down to defaults/inertia etc.
From hearing interviews with PopOS folk, I think this is also a big reason people choose Ubuntu as a base for a lot of Distros instead of Debian.
The traditional answer is that Debian is a bit slower-moving in both the Linux kernel and userland, so people who want current versions of popular software often find that they have to do some extra work in Debian.
A gradually increasing number of popular userland applications have been publishing their own apt repositories however so this is less of a problem now than it used to be.
Over the years though I've found that I much prefer Debian's relative stability and more thoughtful, if slightly plodding, release cadence.
Ubuntu issues a version release every 6 months, and there are updated packages in the interim.
I'm on Kubuntu (home installs) but have been looking to move since Ubuntu went over to Snaps and started breaking everything (MX looks most likely for me). The task of moving the family over is stopping me; I've been using Kubuntu for a very long time now.
For me it's just because I've been using Ubuntu full time since 2008 and has served me well my entire career, I think it's fair to say it's the flagship desktop OS that introduced many to Linux.
I feel like we're close to a post-distro era of operating systems though. My ansible playbook customizes so much already it wouldn't take too much more to just start from debian tbh.
Me same. I'm on ubuntu since 16.04 and it's annoying switching, because I'm used to it so much. Definitely switching on Debian, because they're not shipping software through apt anymore (eg. browsers). I'm running that through nix right now, and I don't want to deal with this nonsense.
I was thinking of just going entirely to Nix. The last time I tried it was 2021 (on a dual boot where I also tried Arch cause my colleague was bemoaning my Ubuntu usage). Yeah, it is annoying having to look up how to configure things the Nix way, but it all makes sense and it stems from the fact every application does it 'their way'.
Either way, I just wanted to note you can use APT to include Mozilla's Firefox and Thunderbird repo. That way, you get a .deb from them.
One specific thing I like about Ubuntu: I know a new version gets released every six months (I believe OpenBSD innovated this?) and the version is recognized by date. The LTS is released every two years around april in the even years. Otherwise it is april/october.
For some reason I had feeling that Ubuntu more "serious" than Debian. I mean they're asking for money from people. So it's basically Debian with paid services. Can't be worse than Debian and probably is better, maybe they paid some engineer with these money to patch things faster.
That's just some rough reasoning in my head.
Also when you install third-party software, 100% of them will support Ubuntu. That's more about workstation usage, though. But having tested platform matters.
Enterprise support contracts for Linux and the compliance legal liability. No large commercial companies would run purely contributor supported systems because of the lack of those two things.
Ubuntu offers a path from free use to paid first party support. For me, that makes it very attractive for a startup or small business that may want to add a support contract later. Ubuntu makes it a lot easier than Red Hat. Paid support for Debian is via third parties. Ubuntu is a solid distro, although I think Debian is a better one if paid support isn't an important feature to have.
Ubuntu has a timeline for how long they will provide updates for a given long term distribution release. I moved over to Ubuntu back when CentOS was converted in to a Fedora type release without a long term commitment to providing security fixes.
This is the big reason that I see a lot of companies using it over Debian.
Five years of guaranteed updates, with an option to pay for another five years ticks the box for accreditors and the like.
The much vaguer Debian policy that a release will be supported for some undetermined period based on how frequently they release, and then get some kind of volunteer-based LTS support for a couple of years after that, and then maybe further through some third-party ELTS program is a much harder sell.
We migrated to Ubuntu from CentOS as well. It was simply because Rocky wasn’t established enough at the time and we haven’t had a reason yet to again look elsewhere. Tho we haven’t also phased out most VMs for containers of some sort.
Historically, Debian didn't ship proprietary wireless firmware in the installer (because it was proprietary software, and Debian doesn't do proprietary), so you couldn't install it on most laptops without plugging them into wired Ethernet to download the wireless firmware packages from non-free.
They changed that a few years ago, but plausibly the underlying prioritization of end-user experience is still lower than Ubuntu's degree of user focus.
I still wish Mark would rename his company "Ubuntu". He's a great guy, the company does great work, but I keep getting undeserved credit for it because we wouldn't sell him the domain name.
If your infrastructure doesn't use landscape, kernel hot patching, JuJu or similar Canonical technology, or doesn't have its own Snap storefront, there's no need to install Ubuntu. Rest is just momentum.
Debian used to move a bit slow in terms of userspace, and that's true, but for servers, that's a non-issue for the last 20 years or so (from my experience).
On the Desktop side, Fedora and Ubuntu moves faster on the userspace front, but if your system is behind a NAT, and you know what you're doing, Debian Testing is just as good, more stable and it's rolling (except when it's feature freeze, but a stable workhorse is better than a shiny but breaking one).
Debian allows me to sleep well at night, provides guaranteed updates, and works rock solid all-round, so I won't be touching Ubuntu for the foreseeable future. Esp, with controversial choices like uutils, etc.
Ubuntu did what Debian failed at. Better LTS, More features including drivers, available by default by most providers, lot more branding/documentation and in the early days, easier distribution. I am old enough to remember distro like SuSe Linux etc and when Ubuntu came on scene, it became the de facto.
At my company, it’s the pateena of “enterprise”. I came to th company with strong open source bias. The more traditional/conservative IT guys were all about Microsoft and RedHat. When I lobbied hard for some Debian assets, Canonical was the compromise. But I think we’re real close now to seeing the next round of allocations be straight Debian.
> What is Ubuntu offering that Debian doesn't provide?
I'm on an nvidia jetson which comes out of the box with Ubuntu pre-installed (it's slightly more complicated but that's the gist). You can run other OSes but it is a messy experience and you can easily run into problems.
Yes, it is shitty from nvidia that they do it this way. But it is also convenient.
They test run a little more tests on their backports (and have the manpower to actually look into what is failing) and they have really far out EoL once the kernel release is selected at fixed intervals. So if you managed to get the capabilities that you care about in their tests, there is a low probability that applying updates will cause some catastrophic outage or data loss over the next 10 years. Which can be improved further by fine-tuning phased update rollouts.
Unfortunately, they did in recent history manage to still break iptables, zfs, nilfs and a bunch of machines with weird (arguably broken) firmware anyway, so my personal comparison between Debian (or simply directly the Kroah-Hartman/Levin stable upstream) and the Ubuntu backports is not exactly in favor of Ubuntu.
Just that it’s already installed, and I haven’t tried a new distro in over a decade.
But 15-20 years ago it was easier to install the nonfree stuff on ubuntu, like drivers and DVD playback and stuff. I don’t know if its still like that.
I never understood ubuntu as a server over debian, but for a desktop it was a nicer experience for a while.
Proprietary drivers, desktop first experience similar to how Mandrake used to be, or SuSE, and the most relevant, in regards to proprietary software on Linux distributions, it tends to be either Ubuntu or Red-Hat.
Consumer-centric customizations and non-free package options.
It’s somewhat akin to answering “How can I add stuff like OneDrive to Linux and not have to configure/self-host everything?”
I used to like Ubuntu and Canonical products and these days I’m more indifferent towards them. Their products have a place, but I wish Canonical would stop killing off some of the more interesting side projects.
Desktop Ubuntu purely because of the drivers. Normally used Debian for my own servers, but haven't done that in so long, and Ubuntu is often default on cloud providers so yeah.
For desktop use, new-ish user-facing packages without any hoops (such as backports) jumped. Especially where collaboration is involved it can be a major issue when a program lags behind its commercial OS counterparts by several months or years in terms of features and behavior.
I don’t use Ubuntu but use Fedora (and its derivatives) partially for that reason.
For me, habit. A habit I'm getting tempted to break by exactly the grumble in this post. This has been an awful ~two weeks for maintaining infrastructure and the ubuntu lag on this specific issue is contributing to the awfulness.
It's the default that a bunch of vendors package. For example, Nvidia's official CUDA images used to only be provided for Ubuntu (they have since expanded their offerings somewhat)
I used Debian on my machines (after I got past their ideological view on drivers and found I could get them separately and made it work) ... until a patch came out and WiFi was broken on my machines. I went back to Ubuntu, have not had issues like that. Ubuntu works reliably, from my experience, on real world machines.
1. Faster and predictable release cadence. New releases every six months, April and October (hence x.04 and x.10). New LTS releases every April on even years (26.04, 28.04, 30.04, etc).
2. The LTS releases are supported by Canonical for at least five years on the free tier, and up to fifteen years with paid support contracts.
Agreed. Two weeks is pathetic. But, yes, I went over to Ubuntu because they were supposed to provide five years of security updated.
When I interviewed with them a couple of years ago, I got the sense there was a lot broken with their culture. It was the best choice back when RedHat/CentOS stopped providing long term security updates, but now that Rocky Linux is around, it’s getting to be time to jump ship again.
Also, almost every other time I upgrade Ubuntu, it's a shit show. I've seen the renaming of network interfaces, loss of default routes, systemd jobs that take several minutes to timeout... It's like rolling the dice. All the problems were fixable, but still an annoyance.
AFAIK Ubuntu still ships newer versions. Maybe this is just because it ships new distro versions more frequently, but the end result would still be having newer packages on the latest Ubuntu release vs the latest Debian stable. I'm not an user of either distros though, so I'll wait for someone that actually uses them to confirm/rebut.
How is the gaming experience on Debian? I'm genuinely asking, not a snark.
I use desktop Ubuntu because it's up to date and it just works for me, and I can play the latest games in it with Steam + Proton. I don't have to tweak it or do any additional downloading of stuff besides the Nvidia drivers (I actually don't remember how I installed them).
Can I do this with Debian, in a no fuss way? (I know this can be done in any distro, that's why I'm stressing "no fuss").
Nvidia proprietary drivers are generally pretty old. I did some messing around with the CUDA packages to get recent desktop drivers in order to run some games.
Not bad. Steam/Proton keep themselves updated. If you rely on Wine from the repos, you might be in for a bad time, but Heroic/Lutris/Bottles in Flatpak stay updated. You mentioned Nvidia, but amdgpu has a repo that should keep things reasonably up-to-date: https://instinct.docs.amd.com/projects/amdgpu-docs/en/latest...
For some games like WoW I use Faugus on Ubuntu. It ensures I always run the latest and greatest Proton-Wayland.
But this is the thing I appreciate about Ubuntu. I know my LTS is from 26.04. I know all my software (with specific exceptions) is backported from that. The previous LTS were 24.04, 22.04, etc. With Debian, I won't know these out of my head. Partly cause I am into Ubuntu, but also because it isn't opaque. I mean, I don't remember from which time Potato and Woody were (but I used to run both back in the days). With Ubuntu, I remember (the codenames of Ubuntu I forgot).
Rest of games, Steam handles. I'm hooked on their ecosystem, kind if for a similar reason as Ubuntu (loyally sticked to them). As European I'd prefer a European gaming distribution platform, but Steam is just good and a fair netizen. Linux-friendly, too. I own a Steam Deck, too. Only reason I'd want non-Steam is all these free games I got on GOG/Epic/Amazon, and maybe some good ol' emulation.
In my experience, Linux distros on older kernels sometimes struggle with modern hardware. Especially with newer devices, features and especially bug fixes take a while to make their way to the distro.
Right? Can I install Debian and have Steam work as well as Ubuntu? Can I install Debian over my Ubuntu (without pain) and keep my dual boot with Windows 10 situation? If yes to both, will consider!
Speaking as somebody who stayed on it way too long (until 10 years ago, maybe) it was because people constantly told me scare stories about how difficult it was to configure into something usable.
I had to go through the torturous path of Ubuntu -> Mint -> Mint Debian -> Debian. The last step was after I used a Debian live disk to do something and I could see that the stories were nonsense; just something that had adhered to the word Debian in my mind through repetition.
The two worst parts about it were 1) that I had long left Ubuntu on servers and had been using Debian there for years - I was just afraid of the desktop for some reason, and 2) that if I had just listened 15-20 years ago when people told me that FrankenDebians were nothing but problems, I would have never been caught in the net.
I've never been a fan of Ubuntu's business practices, but I'm just generally not into Debian derivatives anymore. If I were to leave Debian, it would be for an entirely different (and philosophically different) distro. I probably make an exception for Devuan, because it's only trying to change one thing (that I think of as the biggest threat to Linux, the final boss evil spawn of RedHat.) Devuan is an escape hatch for when the rugpull happens.
It's just the default target. For backend stuff, you're right that there's really very little true value. But client software just has a lot of complexity. If you run binaries from wherever, they're probably built and tested on Ubuntu first. Like, your vendors won't support distros officially, install scripts and AppImage integrations are going to tend to assume stuff. Driver/runtime integration for things like binary GPU stacks are going to document Ubuntu first. If someone makes an assumption about Python version (a personal peeve -- LOTS of python software ends up lagging the tip, it's not a super compatible ecosystem), it's going to be that you're running Ubuntu LTS version "one before latest", etc...
Are those fatal flaws? No. But lots of people just don't want to deal with it. And there's a market for that.
Because every where you used to go on the internet you read that debian is “slow” on updates but stable as a trade off, if you are after certain new packages you have to use Ubuntu, also, some use cases (say jetson boards) have ubuntu by default plus nvidia drivers.
Ubuntu is the gateway drug to Debian, in a lot of ways. You get used to GNU/Linux with Ubuntu, then you find out that there are more refined options and go for those, and a not-insignificant part of that crowd likely goes to Debian because of how familiar it is.
I agree btw. But I've been using Linux since end of 90s (I barely made use of the 2.0 Linux kernel series). I quickly established on Debian in the Potato/Woody era. Debian, back then, was severely slow with new releases. So I ended up with Testing. Which got slower security updates than Unstable. Which sometimes broke (like any rolling release does). Back then Ubuntu got released (we talking '04 and '06). And I just sticked with Ubuntu. On servers, too. I endured it all, including the Amazon spyware, the ads in MOTD, and the switch to an inferior in-house software management for some package (which name we won't mention).
I would need to reinstall OS on my laptop and deal with all time-consuming migration stuff for everything that changed and to configure Debian where it is doing weird things
> What is Ubuntu offering that Debian doesn't provide?
This is now trivial with agentic tooling. I recently used a separate laptop and VM over a weekend with an agent to complete a full migration. Cost is hours and a dollar in tokens.
Back when I used Ubuntu it was because I was tired of being excited about a new feature and not getting to use it until it made its way to Debian 5 years later.
If it's a corporate computer you don't want to deal with manually configuring stuff. I also want as little manual configuration on my personal machines, hence why I use Ubuntu.
It just has package for nvidia drivers. Not sure if installer will install it automatically for you (I kinda... use my install for last 12 years, just upgrading it).
For me both with AMD and NVIDIA whole hardware driver story was "install it, it works"
I'm referring to the ubuntu-drivers thing. You can do the equivalent in Debian if you add non-free repos and find the right packages, it's just more hassle. But if all you need is GPU drivers, no need for that tool.
At least Debian is on Wayland. Mint is on X11, which was causing black screen out of the box on my fairly typical PC.
Suppose you are an enterprise paying large amount of money to NVidia to buy their AI hardware to run AI workloads locally. Are you going to say we will refuse the default OS (https://docs.nvidia.com/dgx/dgx-os-7-user-guide/introduction...) on such hardware and lose hardware support, or are you going to stick with the supported OS for your hardware?
It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.
The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Just a title designed to generate the maximum outrage followed by a few meaningless lines.
> The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Yes it does? And Ubuntu is selling security subscriptions and doing a poor job of it, These aren't open source volunteers, this is a paid product.
But Ubuntu is not some small distro maintained by unpaid volunteers; they are a corporation that offers paid support. I think it reasonable to be disconcerted when a company that you are paying for security updates is this negligent, especially when other distros have fixed this issue far more expediently.
>The post gives no details about what this vulnerability is, how critical it is
what? the literal first paragraph says:
"In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely"
I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...
Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.
If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it
CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).
Go is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.
Also this vulnerability is not strictly about mptcp, although the exploitability is not clear.
Contrast this with: "The Gift of It's Your Problem Now"
We keep doing this to ourselves. Heads should roll at Ubuntu. Start that process right now? You can't. You see, nobody is directly available to sue. It does seem that nobody ever truly cared about that. The insecure codebase and tech debt shall continue to grow because that is the gift.
I think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.
Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.
Yeah that literally is in "does not compute" territory for me. That page literally opens with "Ubuntu priority
High [..] 9.8 · Critical [..] Publication date 15 October 2026 [..] Last updated 30 October 2026" which is exactly why "WTF Ubuntu" is the right response here.
You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.
(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)
You can also use the following Suricata rule if your network firewall supports it:
`drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)`
Because you shouldn't have to do mitigations for this level of severity while waiting weeks for OS patch. I did that, but now I'm waiting for patch to unwind my mitigations.
All the people working at Canonical have gone through the Canonical hiring process, which is quite possibly the worst in the global industry and I can't imagine anyone competent getting through it.
What would you recommend to use on servers? Would you host you apps off Arch? Or better to take Fedora or similar? I am genuinely interested in answers not distrowars
After painful Ubuntu upgrades in the past, I moved to Alma Linux and have been very happy. It takes a small adjustment to dnf instead of apt, but realistically I was over that hump in 30 to 60 minutes and this was before AI. With AI to translate and test install scripts and the like, it might be a 5 minute task depending on how much automation you already have in place. Though even an entirely un-automated setup that is just a README.md, claude wrote me an Alma Linux version of a very ubuntu specific project that gave instructions for Alma instead of Ubuntu, and it worked almost perfectly first time and AI was able to (with prompting) see the issue and quickly found a workaround. We're a small org, but at some point when we hit scale and have compliance requirements, a migration to RHEL is also largely trivial if/when the time comes.
Good question... I run ubuntu on servers because the LTS has clear 5 years of security fix.
I use arch linux for my NAS because it's fun and I don't care if it occasionally goes down but I wouldn't use it for production (on my NAS it's mostly stable but has gone down a few times)
So what's next? Centos is a rolling upgrade, nixos?
As always, it depends on how and what you're managing on it.
VPS/VM?
Debian is a great choice. Use it as base and run your software via systemd+podman if you want the most up to date stuff, Debian tends do lag a bit. It is very low maintenance.
Bare metal?
Fedora Atomic is awesome. It does require an update every other week since it keeps packages closer to upstreams, but this is where the immutable base shines, any issue is an easy reboot to revert. Also systemd+podman for your own software.
I wouldn't recommend Arch on servers.
Edit: clarified Fedora immutable spins are called Fedora Atomic.
I have one Ubuntu Pro server and it has not received the fix yet.
Fedora would have been preferable but that is "not supported" and I had to have Ubuntu.
I think this is the important question. To everyone who is complaining while using Ubuntu for free: People whose software you use for free don't owe you anything.
Of course they don't owe them anything. Ubuntu's reputation is built primarily on people who use it (or used to) for free. They are/were Ubuntu's advocates and what made it popular.
So just as they made it popular, they can make it unpopular. People like me will simply post on our blogs and social media that they should not install Ubuntu. A typical Ubuntu user is not that high on the tech scale, and they listen to people like me for suggestions on which distro.
I don't like ads, and I didn't like logging into SSH and seeing a nag to update to Ubuntu Pro because I had the balls to keep running 20.04 in 2023. I've seen this before on previous releases (and know how to remove the message), but seeing it again was the straw the broke the camel's back.
I have the same general feelings, but then I recall my years as an OSS developer and being abused by people who contributed absolutely nothing to my projects. Not money, not code, not documentation, not even grammar corrections. I'm sure anyone who's been involved with reasonably popular OSS can relate.
I am not contributing to Ubuntu in any way, and that puts it into perspective.
(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)
Edit: Whoah the downvotes and comments. I'm not saying that Ubuntu is doing well here. I'm trying to point out that a a vast percentage of the complainers are not paying customers, and maybe if they did pay, Ubuntu would have more incentive and resources to work more quickly.
People are paying money for Ubuntu, though. I suppose if only the free versions were unpatched we could consider the ethics and merits of who is allowed to complain about what, but when the paying customers are also being left out in the cold I don't think your argument has much merit.
I moved over to Debian and haven't looked back, years ago. Why anyone would prefer Ubuntu over Debian, which is a purer, higher quality, more mature distro, is beyond me.
Normal Ubuntu approach. Not news.
I have personally got a bunch on 10+ year old bug tickets on Launchpad and only lately got a feedback like: "is this still relevant"?
Of course, if one hides a bug long enough it will eventually disappear or become irrelevant.
In the current age of AI, open source means exploits can discovered directly through the code. The flip side is the patches can also be managed.
We are in that period between when software was good enough and when software is certified as secure by the writers.
The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.
Don't expect closed source to protect you. LLMs are very happy to analyse binaries and decompile functions you need. It's barely harder to deal with software you don't have the source for. I did both security and reveng work with LLMs and they don't slow down.
I have fond memories of burning Ubuntu to a CD being my first introduction to Linux. I chose to preserve those cherished memories rather than sully them through actually using Ubuntu.
Substantially worse in my experience. They build the whole OS in CI which is slow and unreliable, and as a result it can take 2+ days for updates that other distros have out in under an hour. You can try mix packages from smash or unstable builds but for stuff like kernels that’s not simple.
If you pick a specific random package update, nixpkgs often has that update months to years before other distros.
If you pick a specific CVE, nixpkgs usually is better with the exception of embargoed ones, where Ubuntu, Fedora, etc get to prepare their patched packages ahead of time.
NixOS also makes it much easier than ubuntu to install your own patches and version of the linux kernel.
For example, assuming NixOS had not yet released the fixed linux version, 6.18.56 (though it has), you could upgrade to it before NixOS did it upstream with this one line:
The debian and redhat based distros all make it so configuring what packages are installed ('apt install' / 'yum install') is a different operation from configuring the packages themselves.
On NixOS, the specification of how to build a package, what package is installed, patches, etc are all in the same language, and so it's a lot more natural to patch things as needed.
And also, LLMs are pretty good at generating working nix, so you can have an agent apply patches to your kernel package with NixOS quite easily. Agents can also do this for ubuntu or redhat, but in my experience they're much worse at it, and it's harder to undo mistakes if they mess up.
This doesn't work in practice. That's not really how OSS works; it's a naive interpretation. I can go into details if you'd like, but first: Have you taken this approach before? What were the results? I find it usually ends up in discussions/arguments with the owners, and it doesn't get merged. And I see the other side too; reviewing PRs is a burden, and the submitters often will fix their own problem, while introducing complexity or problems elsewhere. Also, it's generally MUCH easier for a maintainer/owner to update software than a rando who wants a bug fixed.
I fix it for myself, share it upstream, and have no fucks to give if the gatekeepers review it, reject it, merge it, or belch any purity bullshit in between.
The beauty of OSS is that you don't need permission from anyone to modify the code to your own needs.
> "The free operating system that I use is not giving me enterprise level security updates"
Canonical absolutely is marketing enterprise security updates (at least for those who pay). I don't see this in the paid ESM updates channel yet either?
> Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn't. This is true as of 2026-11-02 14:48 UTC.
Ubuntu is one of the larger companies in the OS space and advertises themselves as providing long term support with rapid security fixes. AFAIK they haven't released a fix for their paying customers either. If they were complaning about arch or debian then I think you would have a strong point, when those distros have fast fixes but ubuntu doesn't I'm not so sure they that criticism of ubuntu is unwarranted.
(Also, ubuntu already has the fix. What they're dragging their feet on is releasing the updated version. I don't think anyone outside ubuntu can help with that process)
Probably depends on the company. Plenty love to publish useless blog posts about how “We, a SaaS company that produces React components, fixed a vulnerability in Ubuntu Kernel” because we’re involved in all of our tech stack like that. Linux kernel, node and react is our stack and we take ownership of it seriously dawg.
The most famous not-free-as-in-beer OS that specifically marks enterprise as their target market actually only fixed this yesterday... whatever you may want to take from that.
>Oh and btw, distros run by volunteers (Debian, Arch, Alpine...)
And Slackware too:
Thu Oct 22 23:04:17 UTC 2026
patches/packages/linux-5.15.223/kernel-generic-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-headers-5.15.223-x86-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-huge-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-modules-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-source-5.15.223-noarch-1.txz: Upgraded.
This update fixes bugs and security issues, including the PwnEscape flaw.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-99999
(* Security fix *)
Slackware is a cool distribution. I really love that it's maintained by Patrick and I enjoy the simplicity and the stubbornness of it's opinionated decisions.
I stopped using it back in 2004 when Patrick had health problems. It seems to be a passion project and it stopped getting updates while he recovered. There is a community behind it but it may mainly be driven forward by him.
It looks like it's fairly slow to get updates, generally, as the last release was Slackware 15 in 2022. Maybe that reflects it's dictator (his word not mine) or maybe it reflects it's stability.
Yet, despite all that, Slackware got this security fix around 10 days ago.
That is with the implicit assumption that the mptcp exploit of this ipv4 tcp bug is the only exploit that will be found. I don't think that assumption will hold true.
I mean.. how many people are using multipath on Ubuntu? This is a big issue for datacenter systems that are using fancy networking features that Ubuntu users probably aren't.
Everyone is just using Ubuntu for free of charge for the most part. You get what you pay for.
On another note, you can probably easily install the Debian kernel onto your machine.
"But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.
Having to get the client into call just so they go and click authorisation for adding some signing keys on VMs (as it was in pre-boot stage) just to add some driver wasn't fun
I suspect at this point that it’s a bunch of techno-bureaucrats at Canonical who are dogmatically sticking with their release cadence because artificial justifications. I have worked in big organizations where The Process, or The $place Way of Doing Things, has become so big that the bureaucracy takes on a life of its own and you end up having a whole team of people who just manage the process so that the people actually doing the work can maybe get something done.
I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.
What difference does it make? Version N (TEH LATEST) is considered secure until it isn't and the same show repeats with version N+1 but we already know it's also compromised.
Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:
> Why is this CVE high priority?
> See ubuntu cvss score
That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.
I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.
[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason
Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”.
Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer.
Plain Debian was always best option; even RHEL dropped the ball on this CVE and that's distro people pay for support
The general advice I've been seeing the past ~8 years is "There is no reason to pick Ubuntu over Debian". I don't know who the opposite advice comes from and why anyone would pick ubuntu for a server.
15-20 years ago the running joke was that Ubuntu is a Zulu word that, roughly translated, means "I don't know how to configure Debian". Ubuntu was one of the first distros that allowed one to readily download proprietary WLAN drivers without dealing with ndiswrapper or compiling half-broken OSS implementations; for this reason it caught fire with the crowd that wanted to try Linux but was otherwise unwilling to deal with such driver shenanigans. I used it on a laptop at the time because I'd heard this and was quite impressed. This reputation for "it just works" has carried them ever since even though many distros now do largely the same thing (except for cheap, obscure, or recently-released hardware).
I took the lazy route with my most recent machine and installed Mint since I wanted to use it for light gaming. I'm going to redo it with Nix sometime soon because the value prop simply isn't there.
Enterprises love paying for support contracts. If you have one, you can demonstrate something has been accounted for. A secure software without support is worse from an audit perspective than a security disaster with proper paperwork. Most of these people never actually involve support they paid for ever.
> Enterprises love paying for support contracts.
They can pay for Debian support! (I’m not 100% sure who they should go to, but e.g. Freexian are doing Extended LTS for Debian [1], so I suppose they could do a regular support contract as well?)
[1]: https://wiki.debian.org/LTS/Extended
A quick search shows all sorts of projects choosing Ubuntu. Can you explain a project like mail-in-a-box going with it? And 5.15 kernel at that..
People make bad choices all the time for many different reasons. Usually, “it seemed like a good idea at the time” is at the top of that list.
Platform support. Oracle Cloud for example only provides images[1] for Oracle Linux, RHEL, Ubuntu, and Windows Server. Anything else you have to bring your own.
[1] https://docs.oracle.com/en-us/iaas/Content/Compute/Reference...
What's your recommendation nowadays?
Debian
The more I look at this the angrier I get. This is a CVE that Anthropic claims can get a Remote Code Execution on vulnerable systems, which includes default Ubuntu installs running any sort of Go server like Caddy. Bad enough that I shut down my personal website and self-hosted tools (sorry for any typos, my grammar checker is also down).
And this is how Ubuntu describes the vulnerability to sysadmins:
How is this in any way, shape, or form acceptable two weeks after the CVE was published?sorry for any typos, my grammar checker is also down
I assume this is unrelated to the Ubuntu situation, but how does a grammar checker go down? We've been doing offline grammar checking since computers had 64K of RAM.
Self-hosted LanguageTool server[0] with browser addon. 18 gigabytes of n-gram data plus machine learning models. You can catch tpyos on 64K of RAM, but not any deep grammar mistakes, un-idiomatic phrases, or mistakes in common proper names.
[0] https://dev.languagetool.org/http-server.html
They're totally asleep at the wheel, it's malpractice. The pitch for RHEL is highly competent maintenance you can't get elsewhere
RHEL also dropped a ball on it so yeah the alternative for paying for RHEL license is apparently "just use Debian or hire some Arch nerds"
I believe RHEL/Alma/Rocky has released patches today. I have a notice about they have done so.
Alma released a patch ahead of upstream again, just like they did for several other critical vulnerabilities this year.
I use NixOS btw
Is RHEL really unpatched still? Looks like patches came yesterday: https://access.redhat.com/security/cve/cve-2026-98432
Thanks, I removed that part from my comment. Still, that's two weeks late.
>Still, that's two weeks late.
Agreed! I know this is a bad month, but this is poor form from several vendors that tout "we'll handle XYZ aspect of security for you".
What is keeping people on Ubuntu instead of just using Debian? I'm genuinely curious. What is Ubuntu offering that Debian doesn't provide?
Back in the day in 2008, Linux was niché.
It had issues all the time, and finding solutions required searching online, manually. Time consuming, difficult process. Very un-beginner-friendly.
From the throve of all possible distros, one stood out. Ubuntu. Very popular. Askubuntu Forums (with coffee beans denoting ranks) was the place when, 9/10 times, the answer to your problem could be found.
So when your fedora friend cried trying to get his camera and sound working, you either found the solutions already, or asked for them and got them. Usually the former.
That was the biggest advantage of Ubuntu. Big community and wealth of troubleshooting knowledge already available. And it had the opinion of a beginner friendly system. Which made the community grow and created a large market/userbase for help threads/tutorials.
Add to that, that people are creatures of habit and 'voila - you have a lot of people sticking to Ubuntu just because they never got so pissed at them that they would change their distro.
Is Debian still considered beginner un-friendly or had it improved in that respect?
I think it's just brand, ubuntu was what I knew from using it as a personal desktop and then it's the default/most obvious option for a lot of providers, I think even 10+ years ago AWS EC2 defaulted to it above Debian, digital ocean too I think?
I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think they got reputation as being the 'just works' option because they were happier to include some non-free graphics drivers etc where Debian was the more pure option but most end users didn't care
But since they added snap and I started running into issues with trying to install Docker etc a few years ago I default to Debian now and most of the time I don't even know which it is.
Stable Debian is using Linux 6.12, if your laptop has modern hardware what do you do? Can't use wifi?
And don't get me started with Debian testing. I want a LTS distro not a testing one.
> Stable Debian is using Linux 6.12, if your laptop has modern hardware what do you do? Can't use wifi?
And Ubuntu 24.04 LTS is using 6.8.
Ubuntu releases a new version every six months, but an LTS — which is probably what most people run in production — only every two years. Debian releases come out every two years.
So if you only run Ubuntu LTS, the release cadence is the same as Debian.
I think you're forgetting about Ubuntu 26.04 (LTS) that is using kernel 7.0.
> I think you're forgetting about Ubuntu 26.04 (LTS) that is using kernel 7.0.
Which only came out a few months ago, and which only recently released its .1, so the do-release-upgrade message only recently appeared for most people.
I'd be interested to know how many folks have changed their current production over to 26TLS in the last six months. I'm guessing not a lot.
So yes, there is a newer LTS, but what is its current market share as compared to 24 TLS (or even 22LTS)?
Ubuntu releases its LTSes in even years, and Debian does its releases in odd years:
* https://en.wikipedia.org/wiki/Debian_release_version_history...
You can use backports if you want a newer kernel, e.g. trixie-backports has 7.2.11.
That, or just pick the kernel package from unstable or testing. Apt is smart enough that mixing packages from different versions of Debian works just fine.
(I mean nothing is 100% but I've been mixing packages for like 2 decades now and literally can't remember any specific trouble resulting from it.)
You opt into backports and run the shipping 7.2 kernel: https://packages.debian.org/search?keywords=linux&searchon=n...
It's not 'as supported', sure, but I'll also note that wifi, at least, has worked on pretty much every modern laptop which I have installed Debian upon.
This and other issues in parent comments is exactly the reason why I switched to Fedora.
> I want a LTS distro not a testing one.
You either want to have the new stuff or LTS. You can't have both.
> Stable Debian is using Linux 6.12, if your laptop has modern hardware what do you do? Can't use wifi?
Why not just install a newer Linux version from the official backports repository if you need it?
https://backports.debian.org/
Debian testing is way more stable than Ubuntu stable. In Debian's parlance, Testing means "release candidate", actually.
If you want real testing, you should run "unstable". If you're in for fun, try experimental.
Running Testing on my desktops and stable on my servers since forever. None of them broke, none of them created problems.
I don't care Stable running 6.x.x. It gets security updates in less than 24h, and is applied automatically before I wake up, and doesn't ship coreutils with 104CVEs, just because it's Rust.
Testing doesn't get timely security updates. It's not for serious people with production systems. It shouldn't even be a debate.
Google disagrees - https://itsfoss.com/goobuntu-glinux-google/
Debian security team used to offer support for testing, but as the distro grew and attack surface increased, that was dropped. However, security incidents are patched in unstable as well and they float up to testing relatively quickly (for a desktop system, anyway). When things freeze, security updates directly land on testing as a fixup polish.
However, while Testing is "relatively secure", it's never "Server secure". I'd never use testing or testing packages in stable or any server for that matter.
I believe I need to reiterate: Stable is for servers, testing is for desktops if you're not directly exposed to internet.
Again. Stable is for servers, testing is for personal use.
I never argued otherwise, ever.
The comment you're replying to makes clear that they're not using it on servers. I do the same thing (testing on my laptop(s), stable on my servers); you just have to commit to keeping track of what's going on and manually patch if you think that it's necessary.
I have to add that for me, testing definitely breaks stuff sometimes. Nothing beyond my ability to fix, though. Nothing beyond anyone's ability now that AI is around.
> I have to add that for me, testing definitely breaks stuff sometimes.
That's interesting, can you give an example? Asking as a curious Debian user.
I hope you realize the irony in your comment. Guess where Ubuntu packages come from?
Well you may want to know that Ubuntu LTS releases are based on Debian unstable, not even testing...
Back in 2005-2008 or so, I think Ubuntu was a genuine breakthrough as a polished desktop version of Linux that set a standard that various other distros, eventually, caught up to. I think Cinnamon and other distros eventually caught up on polish.
They also had credible commitments to long term support that brought people on board. I think that was enough to get them on the map, but personally as a desktop user, I haven't used it in a while, mostly sticking to Debian and Arch.
I think you are right about the branding / reputation. Personally I heard negative things about Canonical and I heard that they just basically follow Debian, so why not use the original? It's been a great experience so far. Perhaps because Debian moved to include proprietary drivers out of the box now it is extremely easy to set up.
The brand I associate with Ubuntu over Debian is increased RAM usage and extremely low performance of the UI.
Using linux for over 25 years now. Tried ubuntu once. Immediately dropped it when I saw an ad in the motd. Not a serious distro in my eyes
For us slow kids in the back, can you link to a .ISO-file of your favorite Debian?
Ubuntu found me (finally, with the tutorialhelp of a localLLM) in 2026, and I don't trust most of the opt-outs.
You are kidding, are you not? https://www.debian.org/download
Guy who can set up a local LLM but not navigate to debian.org
Times are changing! Remember when it was easy to set up WiFi, but difficult to call your doctor and get an appointment?
Now my friends don't have trouble calling doctors, but can't set up port forwarding (not like any games require it anymore).
In the US, my experience is that it's more difficult than ever to get an appointment with a doctor.
Here in NL as well. I attribute it to population ageing (babyboom generation), but AFAIK that issue is much less severe in USA than other countries which suffered in WWII. China is going to have the issue severe due to the one child policy. That population is going to get reduced a lot (not taking into account migration).
In my EU country, making an appointment got extra steps asking about one's mental state, namely depression or loneliness. One wonders if this age of social atomization, people (probably mostly those elderly) are making unnecessary appointments just to have someone to talk to.
Local minecraft server definitely requires port forwarding at the router... as I've learned to my chagrin that Starlink doesn't support port forwarding... Goodbye self hosted minecraft. Did it for nearly a decade and cannot anymore.
Try here...
https://distrowatch.org/index.php?distribution=debian&releas...
seriously? how'd you set a local LLM up if you don't know how to figure that out?
By using a LLM, maybe ?
> What is Ubuntu offering that Debian doesn't provide?
Surprised how many answers here are on "social" reasons, and ignoring that Ubuntu does provide genuine additions to Debian.
Ubuntu includes additional proprietary drivers to Debian. So there are legitimate hardware cases were Ubuntu will work out the box and Debian won't. I can't speak for how many people need those drivers, and how much of choice is down to defaults/inertia etc.
From hearing interviews with PopOS folk, I think this is also a big reason people choose Ubuntu as a base for a lot of Distros instead of Debian.
How many of these additional proprietary drivers are needed on cloud servers, which are based on popular hardware configurations?
What are the numbers of people still installing servers on the real hardware and needing these proprietary drivers?
Precisely, I really don't follow this discussion. Cutting edge drivers is what I want on my gaming PC.
Is AI changing the game where more people want bare metal and GPUs with proprietor drivers?
A fair few years ago I did run Ubuntu on my desktop and laptop when I wanted some more similarity with my servers which ran Debian.
And similar breakdowns with Fedora/RHEL.
But Ubuntu or Fedora on a server? No thanks.
The traditional answer is that Debian is a bit slower-moving in both the Linux kernel and userland, so people who want current versions of popular software often find that they have to do some extra work in Debian.
A gradually increasing number of popular userland applications have been publishing their own apt repositories however so this is less of a problem now than it used to be.
Over the years though I've found that I much prefer Debian's relative stability and more thoughtful, if slightly plodding, release cadence.
Ubuntu just copies Debian's packages. The release cadence is the same: 2 years. It really is just intertia at this point.
Ubuntu issues a version release every 6 months, and there are updated packages in the interim.
I'm on Kubuntu (home installs) but have been looking to move since Ubuntu went over to Snaps and started breaking everything (MX looks most likely for me). The task of moving the family over is stopping me; I've been using Kubuntu for a very long time now.
You can just use Debian Testing/Unstable. It's good enough that's where Ubuntu sources their packages anyway.
Ubuntu is a Debian distribution that releases more often. A faster update cycle for their packages is basically their entire reason for existing.
I may be biased as a Debian user, but if Ubuntu now reacts slower than Debian this may push some people to reconsider their choice.
For me it's just because I've been using Ubuntu full time since 2008 and has served me well my entire career, I think it's fair to say it's the flagship desktop OS that introduced many to Linux.
I feel like we're close to a post-distro era of operating systems though. My ansible playbook customizes so much already it wouldn't take too much more to just start from debian tbh.
Me same. I'm on ubuntu since 16.04 and it's annoying switching, because I'm used to it so much. Definitely switching on Debian, because they're not shipping software through apt anymore (eg. browsers). I'm running that through nix right now, and I don't want to deal with this nonsense.
I was thinking of just going entirely to Nix. The last time I tried it was 2021 (on a dual boot where I also tried Arch cause my colleague was bemoaning my Ubuntu usage). Yeah, it is annoying having to look up how to configure things the Nix way, but it all makes sense and it stems from the fact every application does it 'their way'.
Either way, I just wanted to note you can use APT to include Mozilla's Firefox and Thunderbird repo. That way, you get a .deb from them.
One specific thing I like about Ubuntu: I know a new version gets released every six months (I believe OpenBSD innovated this?) and the version is recognized by date. The LTS is released every two years around april in the even years. Otherwise it is april/october.
For some reason I had feeling that Ubuntu more "serious" than Debian. I mean they're asking for money from people. So it's basically Debian with paid services. Can't be worse than Debian and probably is better, maybe they paid some engineer with these money to patch things faster.
That's just some rough reasoning in my head.
Also when you install third-party software, 100% of them will support Ubuntu. That's more about workstation usage, though. But having tested platform matters.
Enterprise support contracts for Linux and the compliance legal liability. No large commercial companies would run purely contributor supported systems because of the lack of those two things.
Ubuntu offers a path from free use to paid first party support. For me, that makes it very attractive for a startup or small business that may want to add a support contract later. Ubuntu makes it a lot easier than Red Hat. Paid support for Debian is via third parties. Ubuntu is a solid distro, although I think Debian is a better one if paid support isn't an important feature to have.
Ubuntu has a timeline for how long they will provide updates for a given long term distribution release. I moved over to Ubuntu back when CentOS was converted in to a Fedora type release without a long term commitment to providing security fixes.
I might be moving over to Rocky Linux 10.
This is the big reason that I see a lot of companies using it over Debian.
Five years of guaranteed updates, with an option to pay for another five years ticks the box for accreditors and the like.
The much vaguer Debian policy that a release will be supported for some undetermined period based on how frequently they release, and then get some kind of volunteer-based LTS support for a couple of years after that, and then maybe further through some third-party ELTS program is a much harder sell.
We migrated to Ubuntu from CentOS as well. It was simply because Rocky wasn’t established enough at the time and we haven’t had a reason yet to again look elsewhere. Tho we haven’t also phased out most VMs for containers of some sort.
Historically, Debian didn't ship proprietary wireless firmware in the installer (because it was proprietary software, and Debian doesn't do proprietary), so you couldn't install it on most laptops without plugging them into wired Ethernet to download the wireless firmware packages from non-free.
They changed that a few years ago, but plausibly the underlying prioritization of end-user experience is still lower than Ubuntu's degree of user focus.
I still wish Mark would rename his company "Ubuntu". He's a great guy, the company does great work, but I keep getting undeserved credit for it because we wouldn't sell him the domain name.
If your infrastructure doesn't use landscape, kernel hot patching, JuJu or similar Canonical technology, or doesn't have its own Snap storefront, there's no need to install Ubuntu. Rest is just momentum.
Debian used to move a bit slow in terms of userspace, and that's true, but for servers, that's a non-issue for the last 20 years or so (from my experience).
On the Desktop side, Fedora and Ubuntu moves faster on the userspace front, but if your system is behind a NAT, and you know what you're doing, Debian Testing is just as good, more stable and it's rolling (except when it's feature freeze, but a stable workhorse is better than a shiny but breaking one).
Debian allows me to sleep well at night, provides guaranteed updates, and works rock solid all-round, so I won't be touching Ubuntu for the foreseeable future. Esp, with controversial choices like uutils, etc.
Snap is a liability, not a feature.
I don't think we disagree a bit.
Debian doesn't have any of the Ubuntu Pro features, e. g. Kernel live patching.
Even my corp doesn't have Ubuntu Pro, I still have no clue why they use.
Has Ubuntu rolled out the patch only via live patching?
Ubuntu did what Debian failed at. Better LTS, More features including drivers, available by default by most providers, lot more branding/documentation and in the early days, easier distribution. I am old enough to remember distro like SuSe Linux etc and when Ubuntu came on scene, it became the de facto.
Debian's modern release cadence and optional backports seems to have turned this around, to a degree.
I moved all my new server/service deployments back to Debian around 2021/2022 (bullseye era).
I find major version upgrades a lot more reliable on Ubuntu. Every time I've done that on Debian something big broke.
At my company, it’s the pateena of “enterprise”. I came to th company with strong open source bias. The more traditional/conservative IT guys were all about Microsoft and RedHat. When I lobbied hard for some Debian assets, Canonical was the compromise. But I think we’re real close now to seeing the next round of allocations be straight Debian.
> What is Ubuntu offering that Debian doesn't provide?
I'm on an nvidia jetson which comes out of the box with Ubuntu pre-installed (it's slightly more complicated but that's the gist). You can run other OSes but it is a messy experience and you can easily run into problems.
Yes, it is shitty from nvidia that they do it this way. But it is also convenient.
Debian's ancient packages and kernel.
They test run a little more tests on their backports (and have the manpower to actually look into what is failing) and they have really far out EoL once the kernel release is selected at fixed intervals. So if you managed to get the capabilities that you care about in their tests, there is a low probability that applying updates will cause some catastrophic outage or data loss over the next 10 years. Which can be improved further by fine-tuning phased update rollouts.
Unfortunately, they did in recent history manage to still break iptables, zfs, nilfs and a bunch of machines with weird (arguably broken) firmware anyway, so my personal comparison between Debian (or simply directly the Kroah-Hartman/Levin stable upstream) and the Ubuntu backports is not exactly in favor of Ubuntu.
Just that it’s already installed, and I haven’t tried a new distro in over a decade.
But 15-20 years ago it was easier to install the nonfree stuff on ubuntu, like drivers and DVD playback and stuff. I don’t know if its still like that.
I never understood ubuntu as a server over debian, but for a desktop it was a nicer experience for a while.
Proprietary drivers, desktop first experience similar to how Mandrake used to be, or SuSE, and the most relevant, in regards to proprietary software on Linux distributions, it tends to be either Ubuntu or Red-Hat.
Consumer-centric customizations and non-free package options. It’s somewhat akin to answering “How can I add stuff like OneDrive to Linux and not have to configure/self-host everything?”
I used to like Ubuntu and Canonical products and these days I’m more indifferent towards them. Their products have a place, but I wish Canonical would stop killing off some of the more interesting side projects.
It's the default for my VPS provider
Desktop Ubuntu purely because of the drivers. Normally used Debian for my own servers, but haven't done that in so long, and Ubuntu is often default on cloud providers so yeah.
Paid support. Doesn't look like it's worth it, though.
For desktop use, new-ish user-facing packages without any hoops (such as backports) jumped. Especially where collaboration is involved it can be a major issue when a program lags behind its commercial OS counterparts by several months or years in terms of features and behavior.
I don’t use Ubuntu but use Fedora (and its derivatives) partially for that reason.
It’s the default offered by most cloud providers, so in some sense it’s pure inertia.
I really don’t care what I run on, as long as it’s some flavour of Linux, it works reliably, and it’s secure.
For me, habit. A habit I'm getting tempted to break by exactly the grumble in this post. This has been an awful ~two weeks for maintaining infrastructure and the ubuntu lag on this specific issue is contributing to the awfulness.
Their kernel is vastly superior when dealing with buggy enterprise hardware.
Would you mind detailing? I have never encountered that kind of issue, so I'd love to learn more.
Do elaborate.
It's the default that a bunch of vendors package. For example, Nvidia's official CUDA images used to only be provided for Ubuntu (they have since expanded their offerings somewhat)
ZFS.
Use the Proxmox kernel on Debian for that. That's what I do, and it's been great!
I used Debian on my machines (after I got past their ideological view on drivers and found I could get them separately and made it work) ... until a patch came out and WiFi was broken on my machines. I went back to Ubuntu, have not had issues like that. Ubuntu works reliably, from my experience, on real world machines.
Inertia, I'm guessing. I have a couple of older on-prem servers still on Ubuntu LTS. Newer ones are on Debian stable.
I have a company laptop that came with Ubuntu from the factory, Debian wasn’t an option.
ROS, which is not officially supported on Debian. Not using it myself, but users here do use it.
1. Faster and predictable release cadence. New releases every six months, April and October (hence x.04 and x.10). New LTS releases every April on even years (26.04, 28.04, 30.04, etc).
2. The LTS releases are supported by Canonical for at least five years on the free tier, and up to fifteen years with paid support contracts.
For #2, they are clearly not "supported" in a timely manner if we're waiting 2+ weeks for a patch.
You can argue that Canonical isn't upholding their end to provide security support, exactly what TFA is all about.
It's still a pretty basic reason businesses might calculate that Ubuntu is a good fit.
Agreed. Two weeks is pathetic. But, yes, I went over to Ubuntu because they were supposed to provide five years of security updated.
When I interviewed with them a couple of years ago, I got the sense there was a lot broken with their culture. It was the best choice back when RedHat/CentOS stopped providing long term security updates, but now that Rocky Linux is around, it’s getting to be time to jump ship again.
Also, almost every other time I upgrade Ubuntu, it's a shit show. I've seen the renaming of network interfaces, loss of default routes, systemd jobs that take several minutes to timeout... It's like rolling the dice. All the problems were fixable, but still an annoyance.
AFAIK with Debian you remain on older versions of packages (unless you are on Debian testing).
Exactly like with any Ubuntu release. Ubuntu is a clone of Debian.
AFAIK Ubuntu still ships newer versions. Maybe this is just because it ships new distro versions more frequently, but the end result would still be having newer packages on the latest Ubuntu release vs the latest Debian stable. I'm not an user of either distros though, so I'll wait for someone that actually uses them to confirm/rebut.
Ubuntu is based of Debian testing. You can verify this by comparing the versions of neovim available on the repos.
Debian[1]:
> trixie (stable) (editors): heavily refactored vim fork
> 0.10.4-8: amd64 arm64 armel armhf i386 ppc64el riscv64 s390x
> forky (testing) (editors): heavily refactored vim fork
> 0.12.4-1: amd64 arm64 armhf i386 loong64 ppc64el riscv64 s390x
Ubuntu[2]:
> stonking (26.10) (editors): heavily refactored vim fork [universe]
> 0.12.4-1: amd64 arm64 armhf ppc64el riscv64 s390x
I use Debian stable myself and build neovim from source for this specific reason.
[1]: https://packages.debian.org/search?keywords=neovim
[2]: https://packages.ubuntu.com/search?keywords=neovim&searchon=...
How is the gaming experience on Debian? I'm genuinely asking, not a snark.
I use desktop Ubuntu because it's up to date and it just works for me, and I can play the latest games in it with Steam + Proton. I don't have to tweak it or do any additional downloading of stuff besides the Nvidia drivers (I actually don't remember how I installed them).
Can I do this with Debian, in a no fuss way? (I know this can be done in any distro, that's why I'm stressing "no fuss").
Nvidia proprietary drivers are generally pretty old. I did some messing around with the CUDA packages to get recent desktop drivers in order to run some games.
Not bad. Steam/Proton keep themselves updated. If you rely on Wine from the repos, you might be in for a bad time, but Heroic/Lutris/Bottles in Flatpak stay updated. You mentioned Nvidia, but amdgpu has a repo that should keep things reasonably up-to-date: https://instinct.docs.amd.com/projects/amdgpu-docs/en/latest...
For some games like WoW I use Faugus on Ubuntu. It ensures I always run the latest and greatest Proton-Wayland.
But this is the thing I appreciate about Ubuntu. I know my LTS is from 26.04. I know all my software (with specific exceptions) is backported from that. The previous LTS were 24.04, 22.04, etc. With Debian, I won't know these out of my head. Partly cause I am into Ubuntu, but also because it isn't opaque. I mean, I don't remember from which time Potato and Woody were (but I used to run both back in the days). With Ubuntu, I remember (the codenames of Ubuntu I forgot).
Rest of games, Steam handles. I'm hooked on their ecosystem, kind if for a similar reason as Ubuntu (loyally sticked to them). As European I'd prefer a European gaming distribution platform, but Steam is just good and a fair netizen. Linux-friendly, too. I own a Steam Deck, too. Only reason I'd want non-Steam is all these free games I got on GOG/Epic/Amazon, and maybe some good ol' emulation.
In my experience, Linux distros on older kernels sometimes struggle with modern hardware. Especially with newer devices, features and especially bug fixes take a while to make their way to the distro.
Right? Can I install Debian and have Steam work as well as Ubuntu? Can I install Debian over my Ubuntu (without pain) and keep my dual boot with Windows 10 situation? If yes to both, will consider!
I believe Steam just works as long as GPU drivers are working.
On Arch I just installed the flatpak and didn't think about it, everything works.
I didn't have any issues setting this up in Debian
Speaking as somebody who stayed on it way too long (until 10 years ago, maybe) it was because people constantly told me scare stories about how difficult it was to configure into something usable.
I had to go through the torturous path of Ubuntu -> Mint -> Mint Debian -> Debian. The last step was after I used a Debian live disk to do something and I could see that the stories were nonsense; just something that had adhered to the word Debian in my mind through repetition.
The two worst parts about it were 1) that I had long left Ubuntu on servers and had been using Debian there for years - I was just afraid of the desktop for some reason, and 2) that if I had just listened 15-20 years ago when people told me that FrankenDebians were nothing but problems, I would have never been caught in the net.
I've never been a fan of Ubuntu's business practices, but I'm just generally not into Debian derivatives anymore. If I were to leave Debian, it would be for an entirely different (and philosophically different) distro. I probably make an exception for Devuan, because it's only trying to change one thing (that I think of as the biggest threat to Linux, the final boss evil spawn of RedHat.) Devuan is an escape hatch for when the rugpull happens.
Mostly:
1. Hardware generally just works
2. Videos that use patented formats just play without fiddling
3. Proprietary closed-source software, if they even support Linux, usually releases Ubuntu binaries before anything else
It's just the default target. For backend stuff, you're right that there's really very little true value. But client software just has a lot of complexity. If you run binaries from wherever, they're probably built and tested on Ubuntu first. Like, your vendors won't support distros officially, install scripts and AppImage integrations are going to tend to assume stuff. Driver/runtime integration for things like binary GPU stacks are going to document Ubuntu first. If someone makes an assumption about Python version (a personal peeve -- LOTS of python software ends up lagging the tip, it's not a super compatible ecosystem), it's going to be that you're running Ubuntu LTS version "one before latest", etc...
Are those fatal flaws? No. But lots of people just don't want to deal with it. And there's a market for that.
I use it as default for WSL2, because it's a default
Because every where you used to go on the internet you read that debian is “slow” on updates but stable as a trade off, if you are after certain new packages you have to use Ubuntu, also, some use cases (say jetson boards) have ubuntu by default plus nvidia drivers.
much newer software, kernel, default setup is much more user friendly
They have more kernels, more support for modern hardware etc... good luck running Debian on a modern laptop.
Ubuntu kernels are not the one that Debian uses. The latest stable Debian is based on a 2 years old Kernel ( 6.12 ).
"Ubuntu" is an ancient Swahili word meaning "I can't install Debian".
Over the years its meaning has drifted to mean something like "I won't install Debian". It's easy now!
Ubuntu is the gateway drug to Debian, in a lot of ways. You get used to GNU/Linux with Ubuntu, then you find out that there are more refined options and go for those, and a not-insignificant part of that crowd likely goes to Debian because of how familiar it is.
Careful, lest someone's going to mention Arch.
I agree btw. But I've been using Linux since end of 90s (I barely made use of the 2.0 Linux kernel series). I quickly established on Debian in the Potato/Woody era. Debian, back then, was severely slow with new releases. So I ended up with Testing. Which got slower security updates than Unstable. Which sometimes broke (like any rolling release does). Back then Ubuntu got released (we talking '04 and '06). And I just sticked with Ubuntu. On servers, too. I endured it all, including the Amazon spyware, the ads in MOTD, and the switch to an inferior in-house software management for some package (which name we won't mention).
I would need to reinstall OS on my laptop and deal with all time-consuming migration stuff for everything that changed and to configure Debian where it is doing weird things
> What is Ubuntu offering that Debian doesn't provide?
I have it right now at zero additional effort
This is now trivial with agentic tooling. I recently used a separate laptop and VM over a weekend with an agent to complete a full migration. Cost is hours and a dollar in tokens.
I am not trusting LLM to let them handle backups and my critical infrastructure.
And I am not letting LLM to send contents of my private files to LLM providers.
Back when I used Ubuntu it was because I was tired of being excited about a new feature and not getting to use it until it made its way to Debian 5 years later.
Increased safety with Rust utilities. /s
"Ubuntu" is an ancient African word meaning "I can't configure Debian."
If it's a corporate computer you don't want to deal with manually configuring stuff. I also want as little manual configuration on my personal machines, hence why I use Ubuntu.
On the desktop, Debian is pretty weak.
What software can be used on Ubuntu but cannot be used on Debian?
Just because I can reconfigure the entire OS to work on my computer doesn't mean I want to
I think you're mistaking Debian with Arch.
It just has package for nvidia drivers. Not sure if installer will install it automatically for you (I kinda... use my install for last 12 years, just upgrading it).
For me both with AMD and NVIDIA whole hardware driver story was "install it, it works"
I'm referring to the ubuntu-drivers thing. You can do the equivalent in Debian if you add non-free repos and find the right packages, it's just more hassle. But if all you need is GPU drivers, no need for that tool.
At least Debian is on Wayland. Mint is on X11, which was causing black screen out of the box on my fairly typical PC.
Suppose you are an enterprise paying large amount of money to NVidia to buy their AI hardware to run AI workloads locally. Are you going to say we will refuse the default OS (https://docs.nvidia.com/dgx/dgx-os-7-user-guide/introduction...) on such hardware and lose hardware support, or are you going to stick with the supported OS for your hardware?
It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.
The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Just a title designed to generate the maximum outrage followed by a few meaningless lines.
> The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Yes it does? And Ubuntu is selling security subscriptions and doing a poor job of it, These aren't open source volunteers, this is a paid product.
But Ubuntu is not some small distro maintained by unpaid volunteers; they are a corporation that offers paid support. I think it reasonable to be disconcerted when a company that you are paying for security updates is this negligent, especially when other distros have fixed this issue far more expediently.
>The post gives no details about what this vulnerability is, how critical it is
what? the literal first paragraph says:
"In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely"
I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...
Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.
Maybe it's time for StealMyBitcoinV2…
I think the official CTF is up here:
https://ubuntu.com/security
server: nginx/1.14.0 (Ubuntu)
If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it
CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).
Go is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.
Also this vulnerability is not strictly about mptcp, although the exploitability is not clear.
Contrast this with: "The Gift of It's Your Problem Now"
We keep doing this to ourselves. Heads should roll at Ubuntu. Start that process right now? You can't. You see, nobody is directly available to sue. It does seem that nobody ever truly cared about that. The insecure codebase and tech debt shall continue to grow because that is the gift.
https://apenwarr.ca/log/20211229-the-gift-of-its-your-proble...
I think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.
Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.
Here is Ubuntu’s webpage on this vulnerability:
https://ubuntu.com/security/CVE-2026-98432
It’s still, over a week after disclosure and patches, unpatched in Ubuntu.
As for me, a part of me wants to move over to Rocky Linux 10.
Yeah that literally is in "does not compute" territory for me. That page literally opens with "Ubuntu priority High [..] 9.8 · Critical [..] Publication date 15 October 2026 [..] Last updated 30 October 2026" which is exactly why "WTF Ubuntu" is the right response here.
> Rocky Linux 10
Does Rocky use their own community-built packages, or does it use RHEL's?
Because I don't think Red Hat have released patches yet either?
It’s fixed in RedHat:
https://access.redhat.com/security/cve/cve-2026-98432
For RedHat/Rocky 10:
https://access.redhat.com/errata/RHSA-2026:93413
Also, a mitigation:
https://access.redhat.com/security/vulnerabilities/RHSB-2026...
14.04 LTS trusty is not vulnerable fyi.
When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.
For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:
* https://launchpad.net/ubuntu/+source/linux
You can pull them down with a "-t" added to your apt-get (but will not appear by default).
26LTS had the new kernel go to the updates/security repos on October 28.
It's not *just* Ubuntu is it? I think Redhat still hasn't released any patches? (their status still says 'ongoing')
I think they shipped patches yesterday. Which is still a long wait.
https://access.redhat.com/security/cve/cve-2026-98432
Ubuntu has always been worse-Debian, I've always said it, now I have the strongest evidence in my favor.
You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.
(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)
I get the frustration, but isn't there an iptables rule that is a viable mitigation? Why not deploy that first?
Because that doesn't allow for sensationalizing the frustration.
Agreed, it also wouldn't give free advertising to the OP author or to Anthropic who he gives a generous nod to.
Talking of which, is there a link to the temporary fix?
`iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP`
(Taken from https://aws.amazon.com/security/security-bulletins/2026-160-...)
You can also use the following Suricata rule if your network firewall supports it:
`drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)`
Because you shouldn't have to do mitigations for this level of severity while waiting weeks for OS patch. I did that, but now I'm waiting for patch to unwind my mitigations.
All the people working at Canonical have gone through the Canonical hiring process, which is quite possibly the worst in the global industry and I can't imagine anyone competent getting through it.
maybe this was the plan all along.
What would you recommend to use on servers? Would you host you apps off Arch? Or better to take Fedora or similar? I am genuinely interested in answers not distrowars
After painful Ubuntu upgrades in the past, I moved to Alma Linux and have been very happy. It takes a small adjustment to dnf instead of apt, but realistically I was over that hump in 30 to 60 minutes and this was before AI. With AI to translate and test install scripts and the like, it might be a 5 minute task depending on how much automation you already have in place. Though even an entirely un-automated setup that is just a README.md, claude wrote me an Alma Linux version of a very ubuntu specific project that gave instructions for Alma instead of Ubuntu, and it worked almost perfectly first time and AI was able to (with prompting) see the issue and quickly found a workaround. We're a small org, but at some point when we hit scale and have compliance requirements, a migration to RHEL is also largely trivial if/when the time comes.
Good question... I run ubuntu on servers because the LTS has clear 5 years of security fix.
I use arch linux for my NAS because it's fun and I don't care if it occasionally goes down but I wouldn't use it for production (on my NAS it's mostly stable but has gone down a few times)
So what's next? Centos is a rolling upgrade, nixos?
As always, it depends on how and what you're managing on it.
VPS/VM? Debian is a great choice. Use it as base and run your software via systemd+podman if you want the most up to date stuff, Debian tends do lag a bit. It is very low maintenance.
Bare metal? Fedora Atomic is awesome. It does require an update every other week since it keeps packages closer to upstreams, but this is where the immutable base shines, any issue is an easy reboot to revert. Also systemd+podman for your own software.
I wouldn't recommend Arch on servers.
Edit: clarified Fedora immutable spins are called Fedora Atomic.
Debian stable of course.
Did Ubuntu Pro customers get the fix?
I have one Ubuntu Pro server and it has not received the fix yet. Fedora would have been preferable but that is "not supported" and I had to have Ubuntu.
I think this is the important question. To everyone who is complaining while using Ubuntu for free: People whose software you use for free don't owe you anything.
Ok, but in this case it also isn’t available to people who pay.
Apparently they don’t owe anything to Ubuntu Pro subscribers too.
Of course they don't owe them anything. Ubuntu's reputation is built primarily on people who use it (or used to) for free. They are/were Ubuntu's advocates and what made it popular.
So just as they made it popular, they can make it unpopular. People like me will simply post on our blogs and social media that they should not install Ubuntu. A typical Ubuntu user is not that high on the tech scale, and they listen to people like me for suggestions on which distro.
Cut the pipeline that feeds into it.
Nope
I've switched my default to AlmaLinux. Was a fan of Ubuntu since 8.04 (Hardy Heron) but stopped since Canonical pushed hard on Ubuntu Pro.
I don't like ads, and I didn't like logging into SSH and seeing a nag to update to Ubuntu Pro because I had the balls to keep running 20.04 in 2023. I've seen this before on previous releases (and know how to remove the message), but seeing it again was the straw the broke the camel's back.
It’s basically Windows at that point!
I have the same general feelings, but then I recall my years as an OSS developer and being abused by people who contributed absolutely nothing to my projects. Not money, not code, not documentation, not even grammar corrections. I'm sure anyone who's been involved with reasonably popular OSS can relate.
I am not contributing to Ubuntu in any way, and that puts it into perspective.
(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)
Edit: Whoah the downvotes and comments. I'm not saying that Ubuntu is doing well here. I'm trying to point out that a a vast percentage of the complainers are not paying customers, and maybe if they did pay, Ubuntu would have more incentive and resources to work more quickly.
People are paying money for Ubuntu, though. I suppose if only the free versions were unpatched we could consider the ethics and merits of who is allowed to complain about what, but when the paying customers are also being left out in the cold I don't think your argument has much merit.
Sure, and those people have a right to complain.
But, imagine if the complaint vs paid ratio were more equal.
Right now, the ratio is massively skewed towards complainers vs paid. (>99.9% I'd guess)
Ubuntu is a for profit product by a commercial company, Canonical.
Most of it's user base are non-paying "free tier" customers.
This is a valid concern.
AI is now capable of, and being applied to, find so many bugs recently that infrastructure providers need to up their game and respond quickly.
Hopefully this is a passing phase as bugs are quickly patched, and we'll get past it without too many incidents.
I moved over to Debian and haven't looked back, years ago. Why anyone would prefer Ubuntu over Debian, which is a purer, higher quality, more mature distro, is beyond me.
> Why anyone would prefer Ubuntu over Debian, which is a purer, higher quality, more mature distro, is beyond me.
For me, I view Ubuntu as the "higher quality, more mature distro" which I value over "purity".
Your view does not seem to match reality, as shown by this story.
There is a reason I moved to Debian; it is not like I just like the sound of it better.
You can argue about quality I guess, but how would Ubuntu be ‘more mature’ than Debian?
They haven't patched pwnescape either, which is like 15+ days old - allows for KVM breakout.
https://ubuntu.com/security/CVE-2026-99999
Worth noting that RHEL, the Linux version Red Had sells licenses/paid support for, also didn't update it for weeks
Normal Ubuntu approach. Not news. I have personally got a bunch on 10+ year old bug tickets on Launchpad and only lately got a feedback like: "is this still relevant"?
Of course, if one hides a bug long enough it will eventually disappear or become irrelevant.
Yes, indeed, WTF Ubuntu?
I used to be a contributor to distros, but I found that Ubuntu simply has no method by which I can fix things and contribute them back.
In the current age of AI, open source means exploits can discovered directly through the code. The flip side is the patches can also be managed.
We are in that period between when software was good enough and when software is certified as secure by the writers.
The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.
Don't expect closed source to protect you. LLMs are very happy to analyse binaries and decompile functions you need. It's barely harder to deal with software you don't have the source for. I did both security and reveng work with LLMs and they don't slow down.
I have fond memories of burning Ubuntu to a CD being my first introduction to Linux. I chose to preserve those cherished memories rather than sully them through actually using Ubuntu.
Same with the recent PHP vulnerability Debian had the patch ahead of time. Ubuntu had it many hours later...
Good job on moving away from Ubuntu, in the end Debian has been there longer and it's more trustworthy.
It is strange, agreed. I just manually mitigated it using Claude and also blocked ipoptions at the router and in every node iptables.
Should we also talk about the snaps when trying to install package in Docker image (such as chromium-browser)?
I keep Snap disabled on my systems:
cat /etc/apt/preferences.d/nosnap.pref
Package: snapd Pin: release a=* Pin-Priority: -10
So nice to see people coming back around to Debian.
Listened to over a decade of people chirping about the new hotness and calling my Debian servers lame, old and busted. Well look at you now!
> I'm moving all my servers off Ubuntu.
I wish life was that easy.
The "WTF" is unwaranted, it's really not that easy to write a weaponized exploit for a bug like that one.
I am a bit surprised by the panic...
I'm not too surprised, it feels more like a way to help promote Anthropic than what it tries to appear to be.
Debian vs Ubuntu debate officially settled today!
Do most VPSs even use distro kernels rather than kernels from the VPS provider?
I have been thinking of moving to NixOS from Ubuntu. Are they any better on security updates?
Substantially worse in my experience. They build the whole OS in CI which is slow and unreliable, and as a result it can take 2+ days for updates that other distros have out in under an hour. You can try mix packages from smash or unstable builds but for stuff like kernels that’s not simple.
The quantitative data we have shows that NixOS is fresher than other distros in general by a significant margin.
See https://repology.org/repositories/graphs
If you pick a specific random package update, nixpkgs often has that update months to years before other distros.
If you pick a specific CVE, nixpkgs usually is better with the exception of embargoed ones, where Ubuntu, Fedora, etc get to prepare their patched packages ahead of time.
Yes, NixOS has already patched this.
NixOS also makes it much easier than ubuntu to install your own patches and version of the linux kernel.
For example, assuming NixOS had not yet released the fixed linux version, 6.18.56 (though it has), you could upgrade to it before NixOS did it upstream with this one line:
You could add the patch yourself if you needed to with: And then you'd be updated.The debian and redhat based distros all make it so configuring what packages are installed ('apt install' / 'yum install') is a different operation from configuring the packages themselves.
On NixOS, the specification of how to build a package, what package is installed, patches, etc are all in the same language, and so it's a lot more natural to patch things as needed.
And also, LLMs are pretty good at generating working nix, so you can have an agent apply patches to your kernel package with NixOS quite easily. Agents can also do this for ubuntu or redhat, but in my experience they're much worse at it, and it's harder to undo mistakes if they mess up.
Its not just Canonical but yes when a few month ago the local root exploit appeared, it wasn't fixed for a few days either.
It’s been nearly two weeks, a bit more than “a few days”
He probably is referring to Copy Fail/Dirty Flag exploits.
sudo sysctl -w net.mptcp.enabled=0
Switch to vanilla Debian. What I did, no real issues that weren't easy to fix. Rock solid still.
Why use Debían when you can use Rocky or Alma?
There seems to be something off about this post. One hour in and hundreds of comments.
Either this was used to pop something big, or this is a jia tan situation going down.
I thought there was a flamebait automation that was prevent this sort of velocity (unless overridden)
Inflicting some pain to sell Ubuntu Pro maybe?
Ubuntu seems like it hasn’t been in very good hands for quite a while now
"The free operating system that I use is not giving me enterprise level security updates"
I believe you can contribute to Ubuntu's source code right? Why don't you fix the issue then?
This doesn't work in practice. That's not really how OSS works; it's a naive interpretation. I can go into details if you'd like, but first: Have you taken this approach before? What were the results? I find it usually ends up in discussions/arguments with the owners, and it doesn't get merged. And I see the other side too; reviewing PRs is a burden, and the submitters often will fix their own problem, while introducing complexity or problems elsewhere. Also, it's generally MUCH easier for a maintainer/owner to update software than a rando who wants a bug fixed.
I fix it for myself, share it upstream, and have no fucks to give if the gatekeepers review it, reject it, merge it, or belch any purity bullshit in between.
The beauty of OSS is that you don't need permission from anyone to modify the code to your own needs.
Then you build the iso yourself and distribute to every cloud platform? It’s not always that simple.
The glory of OSS is that "you can, if you must" is the answer to every possible what if you can encounter or imagine.
Wouldn't it literally be as simple as hosting a ppa archive with your custom kennel on it and adding that ppa to all target systems?
> "The free operating system that I use is not giving me enterprise level security updates"
Canonical absolutely is marketing enterprise security updates (at least for those who pay). I don't see this in the paid ESM updates channel yet either?
Their main point is that Canonical do in fact charge for security updates (they charge some companies for support), and yet are not providing them.
From the article:
> Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn't. This is true as of 2026-11-02 14:48 UTC.
Ubuntu is one of the larger companies in the OS space and advertises themselves as providing long term support with rapid security fixes. AFAIK they haven't released a fix for their paying customers either. If they were complaning about arch or debian then I think you would have a strong point, when those distros have fast fixes but ubuntu doesn't I'm not so sure they that criticism of ubuntu is unwarranted.
(Also, ubuntu already has the fix. What they're dragging their feet on is releasing the updated version. I don't think anyone outside ubuntu can help with that process)
Getting commit rights for kernel to "just fix the issue" in a corporate led dev project.
Let's see you do it.
Probably depends on the company. Plenty love to publish useless blog posts about how “We, a SaaS company that produces React components, fixed a vulnerability in Ubuntu Kernel” because we’re involved in all of our tech stack like that. Linux kernel, node and react is our stack and we take ownership of it seriously dawg.
The code that fixes the issue has already been published: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
Just not picked up by this distribution which advertises itself as having “Enterprise-grade support and integration”. https://ubuntu.com/desktop#:~:text=Enterprise%2Dgrade%20supp...
But this is C, they're busy porting the patch to Rust...
Two weeks late is hardly “enterprise level”
If they don’t have the resources to handle this, they should be recruiting more help from their community
> The free operating system
Ubuntu Pro is $500 per machine for enterprise.
https://www.gnu.org/philosophy/free-sw.html.en
Do you understand what an enterprise software support contract is?
The most famous not-free-as-in-beer OS that specifically marks enterprise as their target market actually only fixed this yesterday... whatever you may want to take from that.
Ubuntu is not a small open source project ran by maintainers, Canonical is a full fledged b2b company with 600+ employees.
Canonical ltd is a multinational tech company with hundreds of millions of dollars in revenue from enterprise contracts
No updates for paying users of Ubuntu Pro either
Did Omarchy patch it? Anyone knows? (Not that I'm using it now, but I'm interested.)
Arch patched the vulnerability, yes. Dotfiles don't change that.
<animation of DHH in a race car driving bits and bytes to Linux machines>
Yes, this is a fuckup by Canonical
But it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.
So if it's a critical security concern to your company, open your laptop and get to work.
>Oh and btw, distros run by volunteers (Debian, Arch, Alpine...)
And Slackware too:
From: https://ftp.osuosl.org/pub/slackware/slackware64-15.0/Change...Slackware is a cool distribution. I really love that it's maintained by Patrick and I enjoy the simplicity and the stubbornness of it's opinionated decisions.
I stopped using it back in 2004 when Patrick had health problems. It seems to be a passion project and it stopped getting updates while he recovered. There is a community behind it but it may mainly be driven forward by him.
It looks like it's fairly slow to get updates, generally, as the last release was Slackware 15 in 2022. Maybe that reflects it's dictator (his word not mine) or maybe it reflects it's stability.
Yet, despite all that, Slackware got this security fix around 10 days ago.
Slackware is basically a rolling distro in all but name at this point.
Its only the media / publicity that drives this one, there were worse within the last year that nobody seems to care about.
That is with the implicit assumption that the mptcp exploit of this ipv4 tcp bug is the only exploit that will be found. I don't think that assumption will hold true.
There were other fragmentation flaws that were equally as bad as this, I wrote the reproducer.
IIRC it had minimal HN discussion.
> distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix.
Well - Ubuntu sold out to marketing rather than engineering.
Happened to Google too. Compare Google Search to 10 or 15 years ago. Totally useless nowadays.
They are rewriting those bugs in Rust.
you mean to say you didnt review the codebase before putting it in production? you get what you pay for
> Anthropic says it built a working exploit that gets root on a server. A total takeover.
No offense but Anthropic says that every time.
I mean.. how many people are using multipath on Ubuntu? This is a big issue for datacenter systems that are using fancy networking features that Ubuntu users probably aren't.
Go programs listening on TCP have multipath enabled.
I've all but stopped using traditional "Linux distributions" honestly.
i would then give claude/codex full access, and ask it to do a temp patch, if they allow lol.
Honestly, I agree. I need to provision a new VPS for a personal site and I’m holding off until it’s resolved.
Not to mention however many production services teams I work with build and maintain that run on Ubuntu.
Ubuntu are dragging their feet and it’s not good enough. Nowhere near good enough.
Get it patched NOW!
And if you’re on here and you work for Ubuntu, then what the hell are you doing reading this when you should be shipping a patch?
Seriously: get on it, will you?
> and I considered it the solid, no-drama LTS distro. Fuck that now.
There's been lots of drama on Ubuntu which OP either completely missed or ignored. Ubuntu has been getting worse for over a decade now.
Everyone is just using Ubuntu for free of charge for the most part. You get what you pay for.
On another note, you can probably easily install the Debian kernel onto your machine.
"But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.
Having to get the client into call just so they go and click authorisation for adding some signing keys on VMs (as it was in pre-boot stage) just to add some driver wasn't fun
What an awful system
Where is he moving his shit to, then?
Probably Debian.
This turnaround time is appalling, especially given that Debian shipped a fix weeks ago. Poor show, Canonical.
I suspect at this point that it’s a bunch of techno-bureaucrats at Canonical who are dogmatically sticking with their release cadence because artificial justifications. I have worked in big organizations where The Process, or The $place Way of Doing Things, has become so big that the bureaucracy takes on a life of its own and you end up having a whole team of people who just manage the process so that the people actually doing the work can maybe get something done.
I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.
Meanwhile, Debian lol
"If you're not paying, you're the product-" hey jerks, the analogy doesn't always work
> I'm moving all my servers off Ubuntu. Well justified.
all these claude paypigs unable to compile their own kernels in 2026
dismal
i wouldn't even want your jobs because if this is tolerated then it's extremely unsavory anyways
What difference does it make? Version N (TEH LATEST) is considered secure until it isn't and the same show repeats with version N+1 but we already know it's also compromised.
The obvious difference is that version N-1 has a known vulnerability that could potentially be exploited, and everyone now knows about it.
And the version N+1 has exploits only the hackers know so as long as the general public is oblivious it's "secure".
Let's be clear the security vulns will never end and if you're running anything connected to the network eventually you'll get pwned.