Ubuntu has too many problems for me to want to run it. However, it has occurred to me that there aren’t a lot of distros that are like the Ubuntu LTS.
Basic requirements for a LTS:
- at least 2 years of support
- semi recent versions of applications like Chrome and Firefox (might consider flatpak)
- a stable experience that isn’t buggy
- fast security updates
Distros considered:
- Debian (stable)
- Rocky Linux
- openSUSE
- Cent OS stream
- Fedora
As far as I can tell none of the options listed are quite suitable. They are either to unstable or way to out of date. I like Rocky Linux but it doesn’t seem to be desktop focused as far as I can tell. I would use Debian but Debian doesn’t have the greatest security defaults. (No selinux profiles out of the box)
Tbo, that’s a little bit to little research you provided considering you want to use it for work.
E.g. why do you need more than 2 years of support for a workstation?
Stating that debian isn’t secure enough really confuses me as it is one of the most solid distros out there.
Agree, also confused because Debian seemed to get security updates rather frequently when I’ve used it.
That’s like their whole thing, stable and security updates. I would be curious if there are examples of exploits that weren’t patched quickly on Debian stable.
Debian makes it a little tricky to meet security standards. It isn’t insecure from lack of updates but it doesn’t ship with selinux out of the box.
Not “out-of-the-box” but adding selinux to Debian is pretty simple.
https://reintech.io/blog/securing-debian-12-with-selinux
As I see on debian and derivatives apparmor is the way, but not sure if that’s preinstalled.
Enterprise isn’t rolling out the new release on release day.
Enterprise is waiting until the “.1” release so that the most glaring bugs can be identified and resolved. And enterprise is doing gradual rollouts after that, with validation, training, hardware refreshes, etc.
For a release with only two years of security updates, it would not be surprising for a given enterprise to only have the chance to take advantage of, at most, one year of them.
A two-year LTS release cadence with a five-year tail of support and security updates is much more practical. That leaves enough overlap in support for enterprises to maintain their own two-year refresh cadence without having to go through periods without security updates and support.
Where is the toggle to enable NIST-certified FIPS compliance in Debian? On Ubuntu you just enable it using the
proclient and reboot.