[wtbob]

> Honestly, what changed was Ubuntu. Being able to have a fairly robust server on the cheap and maintain it fairly well with just a few apt-get commands was a huge game changer.

That hurts to read. Debian (upon which Ubuntu is based) has been around for decades (literally: it's 22 years old), and has been providing an extremely stable server, for free, with just a few apt-get commands.

> What used to be hours each week of administration work has become minutes a month. It might be less secure, it might be slightly less robust, but overall I don't even think about systems administration anymore and (to me) that's such a huge savings in time that it's just not worth trying to go back.

Or you could switch to Debian and get the same ease-of-use with better security.

If you really wanted security, of course, you'd choose OpenBSD.

[rdtsc]

> That hurts to read.

Why? Ubuntu is based on Debian and I guessing it shares and contributes to same package ecosystem.

> Debian (upon which Ubuntu is based) has been around for decades

Found Debian, after being around for decades, never quite won the desktop market. Debian got there perhaps 80% ofthe way, but the final 20% was just hard to achieve, and I think Ubuntu put a great effort into that 20%, polishing it up and making it a much better experience. After trying Debian, CentOS, Mandriva, Gentoo for my dev machine, I ended up with Ubuntu, and with it I stopped worrying about my OS. Almost everything works. I don't even think about or notice the OS anymore. And that's a good thing!

So, back to Debian, once I want to deploy something and I've played with it on my Ubuntu dev machine, which OS would I evaluate first? Ubuntu Server, of course. So I think the server story paradoxically often starts on the Desktop.

[microtonal]

So, back to Debian, once I want to deploy something and I've played with it on my Ubuntu dev machine, which OS would I evaluate first? Ubuntu Server, of course.

Maybe, but Ubuntu Server has serious downsides when it comes to security updates. Canonical only releases security updates for main/restricted, while Debian releases security updates for the whole distribution. So, if you are using packages from universe/multiverse (which I guess a lot of people do), security updates are not guaranteed. Or as Canonical puts it:

Canonical does not provide a guarantee of regular security updates for software in the universe component, but will provide these where they are made available by the community.

https://help.ubuntu.com/community/Repositories

[rdtsc]

Fair point, thanks for mentioning it.

[msane]

Nobody is knocking Debian. Ubuntu picked Debian, for apt-get and stability, after all.

But apt-get has undergone many improvements because of the swell in Ubuntu users. And that user-base has brought more documentation and energy to linux than any other distro.

[personsunknown]

Ubuntu contributes very little to Debian.

[josephg]

> Or you could switch to Debian and get the same ease-of-use with better security.

Honest question: In what ways is the security story on debian better than the security on ubuntu?

[e12e]

It's not. I've been using Debian GNU/Linux as my main OS for well over a decade, and I love it both on technical merits, and on the great effort put into it to maintain a user-driven, non-profit, democratic (both in the sense of voting, but even more in the sense of participating) organization.

All that said, I've used Ubuntu on and off since it launched, and they've been a great benefit to both Debian and Linux in general. There were some issues in the start, with not handling cooperating and resource sharing very well, there were a few sore people as a result of that -- but as far as I can tell most of those growing pains are well behind us now.

I personally sneer a bit reflexively when people mention Ubuntu on the server, but frankly that's an issue with me, and not with Ubuntu. I got burned by Ubuntu doing stuff like changing gid/uid numbers for system groups/users and little incompatibilities that made it hard to maintain services across Debian old-stable, stable and a couple of Ubuntu LTS releases at the same time for a while (the typical incompatibilities which generally have plagued Linux for as long as there have been more than one distro).

My impression is that since Ubuntu 12.04 pretty much all the major kinks got worked out, including avoiding issues with LTS -> LTS release upgrades - and Ubuntu is now as solid an OS as pretty much anything else.

As for the security bit, I think Ubuntu still comes with more out of the box, both on the server and on the desktop than Debian does. Like eg. the ssh daemon, maybe some bonjour networking stuff. Ever since OpenBSD forced everyone to re-examine what "runs by default" I prefer a cleanly installed OS to not listen to neither UDP or TCP at all out of the box. In that sense, Debian might possibly be considered "more secure" -- but I don't have the impression that there's a big difference in patch rates etc between the two.

Ubuntu/Canonical has gone to great lengths to make Ubuntu for Desktop and Server work out-of-the-box for the great majority of users -- and I honestly think they've done a great job with it. I still prefer Debian, but I also accept that it's a matter of preference not some strict criteria of superiority or the like.

Oh, and I have a special place in my heart for Debian/kFreeBSD even if I've yet to actually get to play with it: https://wiki.debian.org/Debian_GNU/kFreeBSD

Phew. Apologies for the long post - hopefully it has a few interesting nuggets.

[wtbob]

> In what ways is the security story on debian better than the security on ubuntu?

See danieldk's comment: https://news.ycombinator.com/reply?id=12201051&goto=threads%...

I'd add that Ubuntu encourages the use of PPAs, which are a security nightmare.