Linux Mint users in hot water for being slow with security updates, running old versions
- Reference: 1614087235
- News link: https://www.theregister.co.uk/2021/02/23/linux_mint_team_berates_users/
- Source link:
Lefebvre used Firefox as an example. Mozilla's browser is frequently updated and has fixes for security vulnerabilities described by the firm as critical, which it defined as "can be used to run attacker code and install software, requiring no user interaction beyond normal browsing." The latest such update is dated 5 February 2021 (though it is a Windows-only problem).
[1]
"If you're not running the latest version, check which version of Firefox you're using and count the number of critical (red) patches you're missing," [2]he said .
Linux Mint does not collect telemetry data from users, but used Yahoo ! users as a sample to inspect the user agent of Linux Mint traffic – information sent from the browser with every request. "We were able to observe that only 30 per cent of users updated their web browser in less than a week," he said.
[3]
Lefebvre also noted that some users of Mint do not apply updates at all, and that "between 5 per cent and 30 per cent of users run [4]Linux Mint 17 [which] reached end of life in April 2019. In other words, it stopped receiving security patches for almost two years now!"
The exact statistics are uncertain, but appear to have been based on users with the default browser start page and usage of the Mint APT (Advanced Package Installer) repositories. "It really doesn't matter to us if the real number is 10 per cent or 15 per cent. It needs to be 0 per cent," said Lefebvre. The team is so concerned about these users that they "decided to send an emergency update to upgrade your Firefox."
[5]
The Linux Mint update manager includes system snapshots, intended to reassure users that there is a route back
Microsoft, Apple and Google have also wrestled with getting users to update. The solution with most editions of Windows 10, for example, is that updates are compulsory, though they can be deferred. Google's Chrome OS automatically downloads updates and prompts the users to restart to update. Such approaches would not be possible in the free software community, but the necessity of updates for security remains.
In the case of Linux Mint, Lefebvre feels that features such as TimeShift, which snapshots the system so that rollback is possible in the case of a bad update, should give users reassurance that they are safe. It also has an update manager which can be set to make snapshots automatically.
Decade-old bug in Linux world's sudo can be abused by any logged-in user to gain root privileges [6]READ MORE
Why are so many users not upgrading? There are several reasons, and it is not just a simplistic belief that Linux is somehow always secure. "It's naive in itself to assume that all the users yet to upgrade to Linux Mint 20.x are doing so because they are novice or uninformed. There are a plethora of reasons, compatibility and stability being big ones. I haven't done it because of serious issues with video drivers going on between releases 19.x and 20.x versions of Linux Mint," [7]said a user – though this at least is 19.x and not 17.x. Another user said they had an older machine and needed 32-bit Mint, which is not available in version 20.
"I'm gonna be radical (and maybe controversial) here, and say that Microsoft got this right," [8]said another user.
There are pros and cons, said Lefebvre, but updating automatically by default seems a reasonable option since those who dislike it can easily opt out. He promised to return to the topic in a future post and said that the team has "ideas to improve this."
[9]
There is no perfect solution. The idea of leaving something alone if it works seems attractive, but in computing it is not safe – especially for internet-connected machines. Equally, automatic updates can break systems or simply make them perform worse over time; keep an Apple iPhone or iPad up to date, for example, and while it probably will not break anything, it does become more sluggish, as this owner of a 2013 iPad Air can confirm. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YDU0tuDU@W1hp8DLx2jJ7wAAABY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://blog.linuxmint.com/?p=4030
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YDU0tuDU@W1hp8DLx2jJ7wAAABY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2016/01/14/mint_17_3_review/
[5] https://regmedia.co.uk/2021/02/23/update-manager.png
[6] https://www.theregister.com/2021/01/26/qualys_sudo_bug/
[7] https://blog.linuxmint.com/?p=4030#comment-184794
[8] https://blog.linuxmint.com/?p=4030#comment-184794
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YDU0tuDU@W1hp8DLx2jJ7wAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Sounds like an option to present at install-time (obviously with the ability to alter it afterwards) ...
Or maybe, just enable automatic updates by default *but* provide a method that sys-admins / technically aware users can disable this. I personally don't like automatic updates... but I do usually apply updates as soon as they're available.
Kernel panic and video driver problems are more common on Debian based systems that people thinks.
I had several of those over the years, be in Ubuntu, Mint or Debian. And in different machines.
Been using Debian (now Devuan) since 2005 and I have had a few video driver problems, some caused by using older video hardware. However I don't remember ever having a kernel panic after any update and only very, very rarely in normal use.
I've also been using Linux Mint since version 17, now running 19.3, and have few if any video driver problems and NO kernel panics so far. I do keep up it updated regularly, usually on a one to two week interval. I have no problem with automatic updates, but only if I can disable them.
So...perhaps Mint SHOULD have automatic updates turned on.
I suspect that some people do not notice the icon that says that updates are needed. So why not make it become bigger, flash, turn red over several days ?
I run Linux mint on my laptop - which might not be turned on for some time - which might skew their stats.
Firefox is a pain: I will sometimes avoid updating it as once you have done so it refuses to let you open new tabs until after a restart. That is annoying as it interrupts workflow and kills private windows.
You can't stop (or at least I can't stop) Firefox on Xubuntu from updating itself automatically. Could that not be implemented for Linux Mint?
You should be able to lock the version under the package manager.
Could they pick a better example than Firefox?
I use Mint at home and am mostly up-to-date at 20.1, using the little icon that appears in the taskbar - Synaptic? I click on it, see the list of updates, and press OK to install them. It works well. I have (the illusion of) control, even though I click on almost everything anyway - the newer version of a package probably has a bunch of fixes in to make it better. Install away!
Except for Firefox. They mix security updates in with their own special brand of pointless UI changes, configuration over-writes, intrusive unwanted "features" and general misery which makes them bloody hard to like. So rather than swallow every update, I tend to wait a few months until I've got the mental strength to deal with it before doing the update, and seeing what they've managed to ruin this time. At least they haven't disabled add-ons for a while.
Re: Could they pick a better example than Firefox?
"I use Mint at home and am mostly up-to-date at 20.1, using the little icon that appears in the taskbar"
Indeed.
The Icon always alerts me to when there is a new security update.
"Except for Firefox. They mix security updates in with their own special brand of pointless UI changes"
You might want to have a look at:
/usr/share/ubuntu-system-adjustments/firefox
And for goodness sake make changes to Mint's Firefox (including the default web page and search engine) BEFORE you let it connect to the web!
The amount of third party servers that the default Mint Firefox connects to is bonkers!
Re: Could they pick a better example than Firefox?
I used to have occasional some issues with Firefox, but not any longer: I unistalled all Mozilla software after they recently promoted the clamping down of free speech on the internet and even "created a browser add-on that transforms everyday @YouTube users into watchdogs"
https://twitter.com/mozilla/status/1358452973463097355?s=20
Re: Could they pick a better example than Firefox?
Of course I delay Firefox XX.0 updates until at least XX.0.1 is available, after all they're bound to have missed something obvious "whoops we missed that" comes to light. That's usually within a week.
Re: Could they pick a better example than Firefox?
Not to any great extent. It appears from the article that they looked at the versions of Firefox from Mint were visiting Yahoo. That means that the options were limited to browsers. It raises the question of whether Yahoo constitutes a representative sample of Mint users.
I avoid the mental strength to tackle Firfox updates by seldom using Firefox because of their interface; I only use it when I start to wonder how Firefox handles some problem site - or the problem site simply refuses to work without some named browser (not a good sign anyway).
I mostly use Seamonkey, which has relatively few updates and did roll back their latest version almost immediately as it had knackered the address groups interface.
Grump grump grump grump
The problem is that changing things breaks things, not changing things breaks things, what we have is broken to start with, and you kids won't get off my lawn.
There doesn't appear to be a solution. Everyone shrugs, says "the perfect is the enemy of the good," and makes do with systems conforming to an ever lower bar designating "good enough."
Usage case
My Linux machine effectively runs as a mini home server (using the LTS version of Ubuntu). As such, updates are strictly set to manual. I do update it from time to time (usually every couple of months or so), but it will be one of the systems that doesn't show as being on the "bleeding edge" of update compliance. Of course for what I use it for, I don't see this as a major problem. It serves files and a couple of other bits across my local network and I hardly ever use it for web browsing or external stuff.
Problem in this day and age is that updates are a balancing act. The vendors would have you believe that every update is critical and must be immediately applied, yet how many times have updates introduced problems, broken compatibility or changed things that previously worked etc? Hence for me, updating is often about finding that balance between keeping my systems secure, but also wanting to ensure that I don't run into issues that prevent my system from working as it should.
Linux Mint 20 does have several compatibility problems
For example Linux Mint 20 doesn't support my monitor screen resolution by default, I had to switch to an old CTR monitor. And even then the NVIDIA driver by comes by default, even in Mint 20.1, doesn't work.
Is a mite annoying that a monitor from the beginning of the century works but one that's only six years old doesn't.
Unfortunately Linux Mint Debian Edition has the exact same compatibility problems Linux Mint 20.x does so besides avoiding Ubuntu specific problems there is not much point to switching to it.
Solve the Nvida problem and I'll be on board
I have to download the correct Nvidea driver and then compile it for my kernel. (finding the right Linux driver on Nvidea's web site can sometimes be an adventure in itself) I'm actually hanging off the latest update purely because of having to through this pain again... dropping to console, stopping the GUI service, running the Nvidea installer, then running it again as SUDO because I forgot the first time, then being told it failed, having to track down the log file, diagnose what's missing, fix that, then SUDO the installer again... and after too much time faffing about I eventually get it to work. The main desktop I updated and stuck with the open source drivers, only I'm getting flashing windows on one monitor. I mean... it shouldn't be this difficult. Blame it on Mint, blame it on Ububtu, blame it on Nvidea... I don't care who you blame... it just shouldn't be this hard for a driver which is so core to a smooth running experience.
Re: Solve the Nvida problem and I'll be on board
It took me less than five minutes of searching via Duck Duck Go to locate at least two options:
http://www.linuxandubuntu.com/home/how-to-install-latest-nvidia-drivers-in-linux#Nvidia_PPA
https://www.nvidia.com/en-us/drivers/unix/
Re: Solve the Nvida problem and I'll be on board
Yes, this can work. Unless it does not, see my post next to this one.
Just last week an Nvidia card died on me (several years old admittedly), it was a surprisingly happy feeling.
Re: Solve the Nvida problem and I'll be on board
I recently solved that problem (and it *is* Nvidia) by swapping in an old-ish Radeon (AMD) card. Just works. About to plug in an identical Radeon into another computer that had wandering screen artifacts from day one; yes I installed the recommended firmware, it fixed the screen but leads to a solid lock-up (proper dead kernel) within less than two minutes after booting.
Under Linux Nvidia is just a steaming pile and things are not getting better.
Btw. intel on-CPU graphics works out of the box as well.
Guilty
Reasons:
-I'm lazy
-It's currently working
..Oh OK fine, I'll do it now
How about NOT doing what Microsoft Does?
One of the reasons I much prefer Linux over Microsoft Windows 10 is the "Automatic Updates" that quite often cause serious issues and can leave your computer unusable until you decide that a re-install is probably quicker than trying to fix whatever mess they made.
If I want updates, I'll update when I'm good and ready.
How about we say you force automatic updates, you are responsible for fixing any systems that the update crashes... Oh and good luck when an upgrade to Mint happens to mess with your Nvidia drivers and you have disk encryption.....
Updating
Generally I keep systems updated. Those in daily use are current while those connected to the internet but used irregularly are updated when fired up. The only system not updated is an offline Windows system kept around for a couple of applications Swambo might occasionally use, emphasis on occasionally.
An option for automatic updates would be good
I always install the latest Mint updates as soon as they are available, which is almost every day. I'd be quite happy to tick a box to let it download and install everything automatically. Over the last 8 or so years I've been using it, I don't recall any bad updates or problems. Maybe I've just been lucky?
I wonder if a lot of the stats that the Mint developers have collected might actually be from people running Mint in a VM which they just run up occasionally or a live boot from DVD/USB? As I doubt many people would still be running version 17 as a daily driver and also not have bothered to change the default webpage on Firefox.
Generally I'd be against the concept of automatic updates without user intervention.
BUT....Linux Mint is supposed to be the user-friendly, easy to use, "Windows alternative" face of Linux, isn't it? It's aimed at people who want something that works in vaguely the same way and don't want to deal with any of the stuff that Linux has a reputation for, like command lines and tinkering.
So...perhaps Mint SHOULD have automatic updates turned on. People who want more control over their systems can either switch them off or use another distro which doesn't have quite so much hand-holding...
It doesn't help that it's not just YOUR system you're putting at risk. Thanks to annoyances like botnets, leaving your computer unsecured can potentially harm others.