On 8/8/22 09:39, saclug@garymcglinn.com wrote:
My experience with the upgrade treadmill is that it is a waste of time. By its own admission (if a concept can have that) the new versions will have issues and you need to upgrade. If the issues with an older version don't affect you, then it is perfectly fine to use it. Why upgrade and risk the fact that the new issues will affect your use case.
This is a perfectly valid viewpoint. A friend in the computer security industry, a senior developer, agrees with you 100%. Like all things security, this stance has plusses and minuses, but it's sensible.
If that's your choice, there's a premium on defending your system's attack surface, and maintaining due diligence. Since you've chosen Fedora, SELinux should be enabled (I know, there are a million recommendations to turn it off, all wrong) and a solid set of firewall rules should be in place. Certificate-only SSH might have prevented your last attacker from compromising the host, or a 14-character passphrase, or diligent log review. For example (fedora):
# ausearch -ts week-ago --success no --interpret
or maybe
# last -x
I recognize that most security recommendations present hurdles, SELinux configuration and firewall rules are no exception. I'm working on a suite of tools to help with that, but they're not ready for release.
Fedora seems to be at one end of a spectrum, with perhaps Slackware on the other end, where the above strategy seems a little weak. Fedora seems to push out changes quickly and with great tumult, not infrequently requiring patches to their patches. In contrast, Slackware releases after exhaustive testing and review, and doesn't seem to chase - or incorporate- moving targets. I'm not recommending one over the other, just trying to compare and contrast.
The developers for Fedora 13 were no smarter or dumber than the developers who are writing Fedora 36. Or pick your distro of choice.
I disagree. The previous generation of developers (Alan Cox was an exemplar) were more careful, thoughtful, and expert in their craft. Kids these days... Eventually they'll get better, maybe better than the Old Guard. But for now, there are a plethora of semi-skilled Kool Kids in the fray. Perhaps my view is jaundiced because I'm doing front-end (web) development this month.
The issue with an older release is that nifty new things come out and you can't really use them. But, if you run a VM with a recent version of the distro, you can use them just fine.
The other issues is that if you are getting vendor support, they can only reasonably commit to supporting a limited number of versions.
Again, some distributions are like mayflies, some are like elephants. Fedora is perhaps an unconventional choice for longevity.