Re: [gentoo-server] Gentoo for server

[Eric Paynter]

On Tue, December 7, 2004 3:12 am, Mariusz Zalewski said:
> Andrew Cowie wrote:
>> Gentoo is excellent from a security standpoint; either a version bump or
>> a backported patch tends to be made available very quickly, especially
>> on the various things that tend to be in production use.
>
> Did any institution or organization made some measurement? I mean - how
> much time does it take from 0 day (when the critical bug is discovered
> in the most popular server services: ssh, ftp, apache...) to the time,
> when new ebuild is available from emerge? Did anybody made this
> measurement?

Gentoo balances security risks with stability risks and promotes things in
a very reasonable timeframe. No stable distribution has instant promotion
of patches. If Gentoo did, I wouldn't trust it on my servers, because it
probably wouldn't be very stable. But don't forget that the Gentoo team
has to test on a lot more configurations than just what you have, so it
will take some time.

If you think the patch is critical enough, and it's not in portage yet,
then just apply it yourself. If your a professional running real
production systems, than you're being paid to look after your systems.
Stop relying on the Gentoo team to do your work for you. For my servers,
any critical listeners that are on the Internet are *not* emerged. I use
portage for quick and easy base-system maintenance. But my critical
servers that are most vulnerable - e.g. apache, php, squirrelmail, qmail,
courier-imap, etc. - are all hand-rolled. I download the source patch,
build it on a test system, confirm that my applications work against it,
and roll it onto my prod system. For critical patches, it's often done in
a few hours. There's *no way* any distro can beat that time frame without
significant risk of destabilizing most of their user base. I can do it
because I have only one configuration to test.

-Eric

--
arctic bears - email and dns services
http://www.arcticbears.com