you are viewing a single comment's thread
view the rest of the comments
[–] 77 points 6 days ago (16 children)

Remember: update early, update often - no matter how painful that sounds.

Not anymore! Supply chain attacks have become so common that it's prudent to wait at least 7 days before updating to prevent installing malware from compromised update infrastructure.

  • source
  • parent
  • hideshow 16 child comments
  • [–] 13 points 6 days ago (5 children)

    So, what's the solution? Debian Stable?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 17 points 6 days ago* (2 children)

    Debian + unattended upgrades + modern package managers for non-system-installed software covers your bases very well.

    Debian packages are downstream enough from their sources that the packaging delay keeps you safe (and means the updates have had human eyes on them before they hit you). Unattended upgrades means you don’t have to worry about running the upgrades yourself.

    Pip, npm, and the other big package managers now also support dependency cooldowns on their recent releases, but uv and pnpm pioneered that and cover you for older release environments.

  • source
  • parent
  • hideshow 2 child comments
  • Also I would heavily advocate for Debian Testing if you need a rolling release distro. It is less vetted than stable but is still more vetted than many other rolling release options and you can just stay on testing as versions change while getting features pretty fast compared to stable.

  • source
  • parent
  • load more comments (1 reply)
  • load more comments (3 replies)
  • load more comments (13 replies)