Why I'm dropping recommendation of Gentoo

labrador · Guru Joined: 04 Oct 2003 Posts: 316

I've been using Gentoo for a year and 1/2. It has worked fairly
well for me, but I've come to the point where I have to conclude
I spend too much time on maintenance, and I am starting to
have serious concerns regarding the very short QA time Gentoo
has between unstable and stable.

I'm a user who likes to update to the latest security fixes once a week.
I use emerge -uD world, (checking pretend first), and typically
something will go wrong with building a package, or a package
update will break existing functionality.

Here are a list of things Gentoo does wrong:

* purely security related updates not available as emerge option

* QA isn't catching serious flaws that seem to hit dozens of people when package released to stable

* packages that require unstable packages are being released by QA

As a result of the above, Gentoo is a high maintenance distro, and I don't have the time
to chase through the constant stream of issues arising from my 3 personal machines
running it. It will be tough chosing a replacement, and on the Sun I just might stick
with it since there are not many choices.

To balance, here are some things Gentoo does right that play a crucial role in its success:

* User Forums - this just wouldn't work as a mailing list!

* Well written Docs and Guides, with highly readable layout

* Portage - excellent package management system

* Community - forums and GWN and the people here are very good at keeping people connected

* Incremental upgrades design - never install it again

kimchi_sg · Advocate Joined: 26 Nov 2004 Posts: 3038

Goodbye.

AlterEgo · Veteran Joined: 25 Apr 2002 Posts: 1619

There's no need for emerge -uD world, just emerge -u world whenever you feel like it, and most of the issues you describe are gone.
Second: subscribe to the Gentoo security mailing list, and act accordingly if security issues affect you.
My maintenance time (not compile time :wink:

) is less than 5 minutes a week.

labrador · Guru Joined: 04 Oct 2003 Posts: 316

Both redhat and debian make it possible to ask for only security updates.
Gentoo doesn't have it.

The issue is high maintenance. Reading security bulletins and trying
to figure out if I have those packages on each system is very time consuming.
I have 472 packages on one of my systems. I'm not going to commit that
to memory times 3. Try it yourself without using qpkg or another query.
Do you have x11-libs/libzvt on your system? What about sys-apps/attr ,
net-dns/libidn or media-sound/ogmtools?

As for emerge -u or -uD - it doesn't matter. The things I've seen break
would happen either way. In any case, -D in theory should be better
because it recompiles dependancies.

There is a fundamental philosophical problem I have with the Gentoo developer
way of thinking, and the response above is an example of it. The workarounds,
like reading security bulletins, or such as installing someone's private
script to pull ewarnings out of emerge sessions, are not recognized
as issues that need fixing in the core design of the OS.

I'm having problems with having time to maintain 3 systems. How would
a sysadmin maintain a server room of Gentoo boxes (assuming they
were being updated regularly)? If Gentoo doesn't address the high maintenance,
Gentoo will remain a hobby system.

Two years after someone made a bug report requesting that we have a way to
raise the visibility of ewarnings, there is still no official Gentoo solution to this.
I could use the privately developed script to do it, but I won't because it won't
be part of the Gentoo OS. I am not using hacks where a properly designed
and integrated solution should be created. Why? Because I want it to be
part of the QA'ed release. I don't want to find out that the script is unreliable
or does something wierd because it isn't an official part of Gentoo portage's
tools and something had changed.

TrueDFX · Retired Dev Joined: 02 Jun 2004 Posts: 1348

Security updates can be handled with glsa-check. It's part of gentoolkit.

Q-collective · Advocate Joined: 22 Mar 2004 Posts: 2076

Syntaxis · Guru Joined: 28 Apr 2002 Posts: 511 Location: London, UK

Cintra · Advocate Joined: 03 Apr 2004 Posts: 2111 Location: Norway

marcion · Posted: Thu Mar 24, 2005 1:54 pm Post subject:

Well one option would be to offer emerge --security-updates. However if you think about it, one person's non-essential update is a vulnerability that is a show-stopper to another person's system, depending on how it was setup. If you had:

emerge --security-server
emerge --security-desktop
emerge --security-dev-server
emerge --security-filesharingteenager
and so on and so on.

You could basically go on for ever. Who would maintain these? If it is business critical to you and other people then you could cough up some money for it I suppose. At the end of the day, free software means that you are in charge of your own system, and therefore have to learn the issues yourself. MC$haft offers an overall security update service, does it help? Not really.

No offence but if you have 3 computers it doesn't sound like a nuclear power station or a credit card company. Someone could use a security risk in Tux Racer to take over my system but who basically can be bothered. The world would not end if they did. Computers are one of the most secure parts of a business, far more fraud and data loss etc happens through people stealing your bin bags at night or through annoyed employees going to the competition.

An emerge --security might give a fig leaf covering of security but basically the whole system needs to be secure. Near-perfect security would require a feature freeze and then a team to maintain that level of features, I think that is a waste of effort. Computers are about making compromises and finding a happy average and being able to survive if something does go wrong. I also like the idea that the brightest people who are working on the latest packages and know most about them are the same people making them most secure too; rather than having two teams, a team of clever people who make new software and then the leftover dross who are left in charge of your security.

Gherald · Posted: Thu Mar 24, 2005 1:58 pm Post subject:

Okay this "no security updates for old packages" thing has come up way too many times. I'm going to start polishing a rant that I'll link to every time this issue comes up. Here's the first draft:

-rant-

Bleh at everyone who complains about gentoo's lack of security-only updates. bleh, BLEH, BLEH!!!

It is completely antithetical to Gentoo's modus operandi of "rolling updates".

Gentoo developers do not maintain old versions of packages when there is a new stable version of the package that fixes the problem.

If this does not work for you, DO NOT USE GENTOO, and do not complain about it.

The Gentoo devs would love to be everything to everyone but they are busy focusing on NEW software and simply DO NOT HAVE TIME to backport patches to old versions. Why is this not a problem? There are other distributions (gasp!), particularly Debian, that already do an EXCELLENT job of maintaining a secure and stable package tree. Stable in this context means that you are very, very seldom forced to upgrade to a later version of a package in order to have the latest security patches.

This is basically the opposite of Gentoo's "upgrade to a new version at the first sign of danger" approach. Why? Because Debian maintains old versions of packages (which they call "stable"), whereas Gentoo just gives you the latest.

Is Debian more secure than Gentoo? No, the GLSA team and security.debian.org are both top notch security groups. But when it comes to package stability vs. running the latest and greatest software, pick your poison and STFU.

-done-

Obviously not a very rigorous presentation of the case, but the underlying reasoning is sound and I am just getting very tired of rehashing explanations to counter this fundamental misconception of what Gentoo should be.

AlterEgo · Veteran Joined: 25 Apr 2002 Posts: 1619

labrador · Guru Joined: 04 Oct 2003 Posts: 316

People have mentioned glsa-check. I did look at this briefly before and it
didn't seem useful. I run it just now and the first thing I see is:

DNAspark99 · Guru Joined: 03 Sep 2004 Posts: 321

as a fellow sysadmin begining to deploy gentoo in a production environment, I fully agree with the validity of labrador's points. The resolution of these issues would complete gentoo fully, eliminating it's current weakpoints.

Shadow Skill · Veteran Joined: 04 Dec 2004 Posts: 1023

I would think it would be intelligent not to use a tool that warns that it is not official and may contain bugs that could cause some really annoying problems, I would not exactly call the use of such a tool a proper solution in a home or production environment. Having a flag that scans for security updates only is a more proper solution to that particular issue Labrador is having period end of story. In my own experience I have seen ebuilds that essentially point to files that do not exist on the default rsync servers, I have seen ebuilds that have been broken for about six months with the same same error which someone solved by editing a line in the ebuild file, I tried this fix and it still sucked up every last bit of ram and made killing the process impossible. This error was reported here on october 8th 2004 [I would assume there is an existing bug report for the ebuild at least as I do not think this is an actual bug in Pyqt at all.] and the last time I tried emerging pyqt with the fix the error was still present! So in that respect of QA I think I can feel Labrador's pain exquisitely. The "do not use this distro" flame really has no place when addressing genuine concerns, I would hope the developers don't have the same attitude.
_________________
Ware wa mutekinari.
Wa ga kage waza ni kanau mono nashi.
Wa ga ichigeki wa mutekinari.

"First there was nothing, so the lord gave us light. There was still nothing, but at least you could see it."

virtual · Posted: Thu Mar 24, 2005 10:42 pm Post subject:

Hi,

I don't get it only once has an upgrade caused problems which was'nt my own fault, and then just waiting a couple of days and then doing a emerge -uvD world fixed it.

I am an emergaholic and do an emerge -uvD world once a day. I use a nvidia card and have used several models from this manufacturer without problems, I have 2 p4 pc's with different motherbords and chipsets and one laptop with pentium M. I have no problems. It may be that the problem is in the applications you use, your CFLAGS or USE flags I don't know but from my limited experiance with Gentoo it's one of the easiest to maintain (if you don't use unstable packages of course) and very stable. It makes me wonder, I use KDE and a lot of KDE's packages, what packages make the system unstable because it's not portage or the toolchain (gcc 3.3.5 and so on)l
_________________
The roots of education are bitter but it's fruit is sweet.

charlieg · Posted: Thu Mar 24, 2005 11:04 pm Post subject:

As Larry the cow would say: Mooooo.
_________________
Want Free games?
Free Gamer - open source games list & commentary

Open source web-enabled rich UI platform: Vexi

Gherald · Posted: Thu Mar 24, 2005 11:07 pm Post subject:

Anyone here wanna take wag at what happens when an OS tries to be all things to all people?

Seriously folks, this security for old versions thing has been discussed many times before. I think the only reasonable conclusion is that gentoo does not have the dev time nor the motivation to be debian-stable-like.

Disagree with my assessment? Feel free to start your own side project to write ebuilds for backported patches. You won't get anywhere useful, and asking the current devs to take time away from what they do best would be selfish.

It is hard work to maintain old packages. Please, pick the right tool for the right job, and quit asking for the moon on a stick.

labrador · Guru Joined: 04 Oct 2003 Posts: 316

Gherald · Posted: Fri Mar 25, 2005 12:19 am Post subject: Re: Options suggested

jsosic · Posted: Fri Mar 25, 2005 2:02 am Post subject:

Labrador, this is a free world. If Gentoo takes too much of your time, choose Debian Woody, and you won't brake your dependencies. You won't need to recompile, so there wouldn't be any more compile errors and forum reasearches. It's rock stable, has reverse dependencies and great packaging system, not as strong as Portage but still strong enough. If you're not satisfied with Debian, chose any of the other 94238530294850398 distros around here. Try FreeBSD, maybe it will satisfy you. Nobodys pushing you to stay with Gentoo. Nobody kidnapped your daughter to keep you here.

But I don't understand ONE thing. Why aren't you ambarrased for criticising so much about gentoo security issues, and yet, I don't see your's contribution to Gentoo comunity? You except everything and you expect it for free. There isn't a application in portage tree? Don't request, ask if you can be a maintainer. You need maximal security? Try to become "grsec, thisec thatsec uber-duper secure hardened" kernel maintainer? STOP COMPLAINING. Buy a M$ product and than send them your wishlists!

This comunity doesn't need arrogant people requesting, demanding, wishing, wanting, debating and waiting on others to do something for them.

And one more thing, goodbye.

labrador · Guru Joined: 04 Oct 2003 Posts: 316

hollywoodcole · Posted: Fri Mar 25, 2005 5:51 am Post subject:

I don't understand why you guys waist your time replying to this post. I have seen allot of posts that start just like this and by now even to me its getting old. I see every other week someone saying something about how gentoo is unsecure and then go one to compare it to redhat and debian and how you can specify only security updates. Then they talk about they hate gentoo and are giving up on it.

Your not helping saying that your leaving gentoo alone, you should have just offered your suggestions!

I should hope by know from the number of post you have you know that you can make gentoo as stable and secure as you need it to be and also specify what packages you want!

Here is another option for people who complain, there's always Windows!
_________________
If the code and the comments disagree, then both are probably wrong.
---/usr/games/fortune

Hollywoodcole.com

Gherald · Posted: Fri Mar 25, 2005 7:34 am Post subject:

djdunn · l33t Joined: 26 Dec 2004 Posts: 812

its most of the time not a problem of QA when something breaks. emerge fails most of the time due to a configuration error.
_________________
“Music is a moral law. It gives a soul to the Universe, wings to the mind, flight to the imagination, a charm to sadness, gaiety and life to everything. It is the essence of order, and leads to all that is good and just and beautiful.”

― Plato

jsosic · Posted: Fri Mar 25, 2005 9:35 am Post subject:

Labrador, you don't know what are you asking for. Whole another portage tree as someone mentioned... Another way to comply to your wishes is a "step back", for example x86 becomes "stable", and ~x86 becomes what x86 currently is. You and few alike would be satisfied, but allot of users would go away from Gentoo. Love it or not, Gentoo IS BLEEDING EDGE. Maybe one day third tree will be introduced, but what I am saying is stop demanding it and propose that thing to developers, start working on it and get your hands dirty. That kind of tree requests additional maintainers and lots of additional work to be done, but hey, you DON'T HAVE TIME to develop, improve, test. But you have time to argue on gentoo forums. Nice to know... Gentoo is a free product maintained and developed mainly by volunteers. And how do you know somebody else has a time for something that you don't?

I bow to KDE maintainers for braking KDE packages into pieces, but noone dared to demand such a huge effort from them, they did it themselves! Why can't you do the same thing? Take at least two packages and maintain their's stable version. Find another 50 people agreeing with you and make them maintain some other packages and here you go, you'll got a stable tree.

Every distro has it's advantages and disadvatages, so has gentoo. I admit, every now and then something breaks, especially from ~ tree, but nothin' horrible as you described it. Gentoo is a bleedingedge distro at the end. Shout at Redhat for Fedora havin' all those latest versions and not having them in stable branch with dozens of security fixes. Or buy Redhat Server for that purpose. It's the sam with Debian, use Woody. Why do you want to stay with Gentoo? To be cool or something? If it doesn't suit you, I repeat, there's a hundreds of other distros out there. That's the purpose of distro's, to fullfill what people demand.

What are you asking from Gentoo comunity is the same thing as if you asked Debian to abandon thing what they call stable at the moment (Woody), cause versions are very old and outdated. If you said that they should spend more time fixing Sarge and making Sid useable, than patching some prehistoric version of PAM. Try to do this on debian forums, and return us some quotes, will you?