Remote profile

When did grocery stores replace "oldies" with music that was popular when I was young?

If you want to build a safe system, you must understand how perception affects practice.

People tend to work to prove the things they want to be true.

If a system is perceived to be unsafe, then people may be motivated to do the work needed to make it safe, to disprove perception.

But once it's perceived to be safe, they may neglect that work, because they no longer feel the need to defend their belief.

Complacency is the enemy when safety depends on labor.

There are a lot of distributions to choose from, and many of them are built on a foundation of one or another "LTS" system.

Some developers do this because they believe the "LTS" foundation does most of the work, so they don't have to. But that assumption might be broken. If everyone uses the LTS as a way to avoid doing the heavy lifting, then the heavy lifting doesn't actually get done, and you have a foundation that's mostly unmaintained.

Free Software distributions are self supported systems. Many think that self-supported means there’s no helpdesk, and they don’t need one. But "self supported" really means that you're the one responsible for the maintenance of your systems. You can choose not to follow upstream releases, but if you're not participating in CVE review and backporting patches, it might not get done. That’s the real price of Free Software.

@SeaGL Your distribution labels itself "LTS". Does that mean that every package will get security updates long term?

Join us for SeaGL, October 23 and 24!

Let''s look at what's LTS and what's just unmaintained, and how that affects your security.