8

My point here is not to go against the closing, it was a community decision, but to try to better understand since I have the impression to miss something in what I feel to be a possibly basic but nevertheless correct question.

As a non-commercial user,

The OP starts by stating the context of his question, which is good thing.

what distribution should I consider to be reasonably confident that I will get timely security patches?

Granted, this one may sound as a product recommendation, but from the sequel below I'm not sure that the OP really expect an actual name but merely advices on how to choose.

My current strategy is to pick one of most popular distributions and hoping for "enough eyeballs effect" to take place.

Talking about how to choose, the OP present his current criteria so we can provide a feedback whether it makes sense or not.

Are there distributions that have noticeably better track record than others?

Now he asks for objective information sources which can help in this decision. To some people here these track records may be obviously a wrong criterion, but from a marketing point of view it is what is used by some commercial Linux distributions which are fighting against others by producing statistical charts "prooving" how they perform well against the competition (for what matter, yes Oracle Linux I'm looking at you).

At this point, the fact that marketing people are precisely targeting this aspect makes me think that the OP is not the only one to think this way and that it worth a question and an answer.

For example, good distribution would have most fixes available as updates within hours, while bad one would make applying critical patches unnecessarily hard (and no way to make them automatic).

Still seeking for objective criterion, the OP does not limit itself to the time needed for the patch being available, but also for the complexity caused by the the patch application (which is a right mindset, some distributions for instance providing only a source code patch requiring compilation, or bundle the security update with new features which could require configuration changes to get it running).

I suppose I must misinterpret something here, since I just see someone asking for advices, and not opinion, in a question generally well formulated (puts a general context, shows personal research, suggest objective possible criterion as a example and request for feedback on these).

  • 5
    You can help the OP edit the question. For instance, you'd want to edit in "what are the criteria of a secure/usable distro". Your answer, BTW, could benefit from mentioning the advantage of LTS releases and interface stability. – Deer Hunter Nov 2 '15 at 14:58
  • @DeerHunter: Thanks for the suggestion, I tried to edit the OP and my post accordingly! – WhiteWinterWolf Nov 4 '15 at 17:24
4

Granted, this one may sound as a product recommendation, but from the sequel below I'm not sure that the OP really expect an actual name but merely advices on how to choose.

"Advice on how to choose" is the definition of opinion-based. Each person is going to give a different perspective on the problem.

It's good that the OP put down the time frame that he considers to be "Good security", but in the end we'd need to have real statistics to answer this. How fast does Ubuntu, Debian, FreeBSD, Mint, etc release patches? Is that time reasonable? Who determines complexity vs. reasonable response time?

I see what you're saying, and the OP did their best to narrow the scope of their question. But I believe that the answers received would have been strictly that of opinion, and not based on any real statistics. It's not that the question is primarily opinion-based, but that the answers generated will be inherently opinion-based. If that makes sense.

  • Thanks for your answer. If I understand you correctly, the OP should have asked "Is there any distribution" instead of "What distribution", but the former seems a bit unnatural for someone who doesn't know already the answer, ie. all major distribution are roughly the same on this. However, I can edit the post to alter this if this make it look less "opinion based". – WhiteWinterWolf Nov 3 '15 at 12:49
  • 1
    Regarding the "Advice on how to choose", it calls for objective criterion, not opinions, there is huge a difference between "advice on how to choose" and "advice on what to choose**", as underlined in Q&A is Hard, Let's Go Shopping! which explains the difference between the out-of-topic "What's the best low light point-and-shoot camera?" and the on-topic "How do I tell which point-and-shoot cameras take good low light photos?". – WhiteWinterWolf Nov 3 '15 at 12:50
  • 1
    I agree it calls for objective criterion, I just don't believe that there is data to provide a distinct answer for that criterion. It's a valid question that will yield opinionated answers. – RoraΖ Nov 3 '15 at 12:56
  • "I just don't believe that there is data" : And if this was the actual answer? Marketing people show shiny graphs telling their distro is the most secure because they have the fastest security update release from the Universe. I find it quite logical that someone hearing this discourse comes here, ask for some data to confront with these marketing's stats, and we answer this is just commercial bullshit and provide a few information on how security patches are delivered and what could really impact the delivery. The answer people need is not always the answer they are asking :) ! – WhiteWinterWolf Nov 3 '15 at 13:04
  • For information, I tried to edit the OP post, I hope it now appears less "opinion-based" ;) ! Thanks again for sharing your point-of-view :) ! – WhiteWinterWolf Nov 4 '15 at 17:25
  • You're welcome! I saw the re-open vote. I chose to skip it, and let others decide on whether to re-open or not. It's a nice edit, and after reading it seems it might be more of a Super User question. But I think the argument could be made either way. – RoraΖ Nov 4 '15 at 17:30
  • I understand. This is a Linux specific question about security from end-users perspective, typically the kind of cross-over question hard to put in a precise category ;) ! – WhiteWinterWolf Nov 5 '15 at 12:28
  • Looks like I'm a little late to the party. @WhiteWinterWolf - I was voted to close the original question for the reasons RoraZ states. It just seems likely to start a free for all in the answers. That said, I think your viewpoint is valid as well. I'll try to be a bit more thoughtful going forward on similar borderline questions. – Neil Smithline Nov 9 '15 at 8:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .