[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: rkhunter on Etch





Johannes Wiedersich wrote:
On 2008-08-28 10:00, Tim Edwards wrote:
The way Debian does it this is the same as virtually every other major
Linux distro - Suse/OpenSuse, Redhat, Fedora, Mandriva, Ubuntu etc. That
is they release a new distro version every X months, in Debian-speak
these are called 'stable' releases, and then provide *backported*
security and bug fix updates for however long that version is in
support. These fixes are backported into the version of each package
that was released with the distro to ensure stability - as no new
features are being added the behaviour of the packaged software
shouldn't change. But you still get the benefit of security and bug
fixes so you get both a stable system (as in the behaviour of the
software on it is consistent) and a secure one (up-to-date on all
security patches).

That's new to me. Were did you get this information? IIRC it's a unique
feature of debian (and/or debian based systems) to get security fixes
backported. As an example, see suse's security annnouncements, where
first firefox is updated to version 2.0.0.13 [1] and later to 2.0.0.13
[2], ie. the fixes are *not* backported to 2.0.0.13.

That's what I mean - they've backported the security/bug updates into their firefox 2.0.0.13 package, ie. it's still firefox 2.0.0.13 but with some fixes from 2.0.0.16 (or whatever the latest is) included.

This is taking a patch and applying it to an older version of the software than it was intended (http://www.reference.com/search?r=13&q=Backporting) and it's certainly not unique to Debian. On RPM distros they increment the release number on the RPM when they do this.

http://www.redhat.com/security/updates/backporting/?sc_cid=3093


Reply to: