Re: xz backdoor

["Francesco P. Lovergine" <frankie@debian.org>]

On Sun, Mar 31, 2024 at 12:39:55PM +0200, Johannes Schauer Marin Rodrigues wrote:
> In summary: would running unstable instead of bookworm let me find more bugs
> than running bookworm with unstable chroots? For my specific work: yes,
> absolutely.  Am I upgrading from bookworm to unstable or at least testing?
> Absolutely not. I just don't have the amount of free-time this would require of
> me.  Just performing the 12-13 bisection steps to find the offending kernel
> commit which makes my system lock up would easily require a day of free time
> from me.  I'm afraid I do not have this luxury. Not even remotely close!

+1 

I run stably and alternatively 4-6 different personal boxes during the week, all
with stable. Dedicating time to debugging silly egg-and-chicken breakages due to sid
life cycle (anyone nominated 64t saga?) is out of discussion. I did
that years ago, when I had more time an less personal boxes to run.

> So I'll continue to not dogfood as hard as I could and run as much from
> bookworm as I can. Would it make me a better contributor if I ran unstable?
> Certainly! But this thing is just a hobby of mine and I can only allot that
> much time to do risky experiments with my only computer. I guess others are in
> the same boat?

I would also add that even stable/oldstable needs care, and I need to support
multiple users to have a decent workflow on them. Our main network runs
about a dozen of general purpose stable servers/VMs and that's more than enough.

That said I still run a single sid boxes (no GPG/essential keys there)
and I would add that some bugs can be seen only at stable upgrade time
or during the testing life-cycle, not when one runs sid all time. 

A lot of issues can be found only by running accurate tests on fresh
boxes, not via sid daily use, which is only a part of the whole story.

--
⢀⣴⠾⠻⢶⣦⠀ Francesco Paolo Lovergine
⣾⠁⢠⠒⠀⣿⡁ Debian Developer
⢿⡄⠘⠷⠚⠋⠀ 0579 A97A 2238 EBF9 BE61
⠈⠳⣄⠀⠀⠀⠀ ED02 0F02 A5E1 1636 86A4