Automatic Updater??

Post by **clem** » Fri Sep 07, 2007 6:03 pm

Hi,

It looks like you found answers for question 1

In an ideal world security updates would be thoroughly tested and 100% safe. They would also recompile needed modules. The truth is they aren't and they don't. Therefore we need to choose between stability and security. From my point of view the threat of updates crashing a system is greater than the threat of a security hole at the moment. It might change in the future if security threats get bigger or if Ubuntu change their upgrade policy. The situation is complex and important enough for us to decide not to give that choice to all users but to leave it as a possibility to experience users through the use of synaptic and the command line.

It's a highly controversial move. It will make noise but I believe it's for the best. Our goal is not to take control away for the user and make a click'n run operating system but to guarantee freedom to experienced users and wise default policies to others.

Clem

exploder · Post by **exploder** » Fri Sep 07, 2007 8:31 pm

I think the removal of the Update Notification is a good idea. Linux based systems are seldom targeted for attacks. Most security updates fix potential problems.

If the proper repo's are enabled in Synaptic no harm from updating will occur. New user's will want to use Synaptic to add applications they are interested in anyways.

I always get rid of Update Notification, it is annoying and wastes resources. There is no reason why a new user can't learn to use Synaptic.

Just my 2 cents.

leo72 · Post by **leo72** » Mon Sep 10, 2007 9:44 am

I am a user of them how like to keep their system up to date and so the choise to leave the Updater out of the next release let me confused...

I know that there are distros that choose the stability as their main feature (i.e., Debian and Slackware) but I prefer to have my system with the latest versions of every package.
KrazyPenguin talked about Firefox/Thunderbird and their security issues (fixed in 2.0.0.6): what happened without Updater? An user would have had his system insecure for for a least 5 or 6 months (the time between 2 releases), and this isn't a good thing...

I hope that a way to choose between Updater on and off will be introduced in next Mint.

linuxviolin · Post by **linuxviolin** » Mon Sep 10, 2007 12:47 pm

leo72 wrote:what happened without Updater?

If you really want to do updates use Synaptic. No need of the Update Manager.

leo72 wrote:I know that there are distros that choose the stability as their main feature (i.e., Debian and Slackware) but I prefer to have my system with the latest versions of every package.

Yes and also crash, bugs etc which arrive sometimes with them

Stability must be preferred to "the latest versions of every package."
Also see the Husse post at http://www.linuxmint.com/forum/viewtopi ... 3000#33000

But as a criticism, I find that it is a pity to have to make a new installation with each new version. A Linux system should be able to update itself to the next version without reinstall. e.g. Pardus and Frugalware are perfect in this but Ubuntu.... I "hate" that.

(I like Mint much but nothing is perfect

)

hugh · Post by **hugh** » Mon Sep 10, 2007 3:56 pm

Why not put it in Board Announcements - "Important Security Update to Firefox" or some such message - by highlighting the most important and Mint relevant updates, users can go along and install them if they choose, on the devs recommendation.
That way the irrelevant or potentially dangerous updates are avoided.

More work for the staff, though

Cheers,

Hugh

leo72 · Post by **leo72** » Mon Sep 10, 2007 6:48 pm

Yes, a patch can contain some issues itself and so another patch to patch the patch is needed (

)!
But usually I prefer a system that informs me that there are updates: I think that there are people that work for me looking for bugs and fix them offering at the community newest packages

One idea for developers: why don't they create a repo in which they collect only important updates so that any user can choose, i.e., to connect to that repo and check is something _critical_ has been fixed and the patch ready to download/install?

linuxviolin · Post by **linuxviolin** » Tue Sep 11, 2007 4:09 pm

todds · Post by **todds** » Tue Sep 11, 2007 4:47 pm

Hello all this is my first post to the mint forums,i have busily reading all the comments regarding the notifier and updates etc,i believe celena should at least provide an easy upgrade path for security fixes in the least,i have been using slackware,arch,simply mepis and understand the philoposy behind having a stable distro but we need a page as previously mentioned notifying us of uprgraded security packages...

It looks like linux mint is also on a six month release cycle,which is good as far as having something new to install every few months but personally i would like to see an upgrade path through a gui package manger/command line of some sort to newer versions instead of having to reinstall every six months or so,there might already be an option to do this as iam still in the process of digesting the website and forums.

regards

todds

linuxviolin · Post by **linuxviolin** » Tue Sep 11, 2007 5:15 pm

Hi todds, welcome to Mint!

todds wrote:but personally i would like to see an upgrade path through a gui package manger/command line of some sort to newer versions instead of having to reinstall every six months or so,

I agree with that. As I said in a post above, I think that it is a pity to have to make a new installation with each new version.
But clem said

There will be an upgrade path from Cassandra to Celena when Celena becomes stable.

(a .mint file probably)

todds · Post by **todds** » Tue Sep 11, 2007 5:49 pm

linuxviolin
thanks for the welcome seems a very friendly place,i think the community also makes a good distribution,that is good news as regards the upgrade path,i am currently running the celena beta iam a distro junkie but iam getting very annoyed with this habit as i want to settle for one distribution and stick with it,trouble is there are so many distributions,looks like i will be sticking with linux mint for the longhaul this time though very impressed.

regards

todds

linuxviolin · Post by **linuxviolin** » Wed Sep 12, 2007 6:23 pm

@ veloct

Sometimes that's not possible when the change is a "big" change like changing glib libraries, etc

Pardus (from 2007 to 2007.1 for example) or Frugalware (among others) update perfectly from one version to another... So why not Ubuntu could not do it? you say "it is still Linux", yes and precisely! Upgrading should not be known to usually break the system.

leo72 · Post by **leo72** » Wed Sep 12, 2007 6:33 pm

I would like to understand one thing (maybe my english is not good enough): when Clem says that Updater will not be present in Mint 3.1, what does he mean?
1)
the Updater software will not be present in the distro so none will be able to upgrade the system;
2)
the Updater software will not be installed by default but it will be present in it.

The first scenario is not good for me; the second one is more acceptable: anyone can install Mint 3.1 and start using it as it is, but if you want to keep it up to date (and you accept to modify system packages too) you can activate the Updater.

linuxviolin · Post by **linuxviolin** » Wed Sep 12, 2007 6:46 pm

leo72, read clem at http://www.linuxmint.com/blog/?p=54 for more explanations

leo72 · Post by **leo72** » Fri Sep 14, 2007 6:58 pm

I could think that keeping your own system up tp date is different than upgading all your system.
I mean, one day you could find that newer version of package X is available. You upgrade it. Next day you find that package X is still in the updating list because, maybe, a bug has been found in the previous release and so another version is released to fix it. At the end, the package has been updated 2 times to have a stable and secure version of it.
Maybe Clem wants that users use only the distribution packages because they could be the safest, most secure and stable available at the time of distro release.

But I'm of them who think that newer is better than older: more functionalities, more improvements, more everything...

I've used Mint for a very short time but I think that this is a very good distro and I've chosen it as my desktop distro. I like Cassandra as it is. And if in Celena I won't find the Automatic Updater I will install it...

Post by **clem** » Sat Sep 15, 2007 5:14 am

It's a matter of testing the security updates and mark them as "safe" before users actually download and install them. Most security updates are indeed safe and they do fix security holes but a few of them create problems that most users don't know how to fix:

- X crashes
- loss of hardware support (wifi, sound, etc)
- changes in the way devices are called (from sda to hda in Cassandra)
- various and unpredictable things.

When somebody tells me he's got a problem with his power management, the first thing I ask him is whether he's upgraded to the new kernel...

An experienced user will go to the command line or synaptic and only select safe updates. If he decides to take a kernel update it's because he knows how to revert to the old kernel or how to fix his display.

A novice user should not be confronted to these kind of risks and that's the reason why the notifier is gone.

In Daryna we want to have mintUpdate so that the user sees ALL updates but also have him warned about those potentially risky ones and have them not selected by default.

It's all about stability of the system for novice users. It's going to work, it will be a huge improvement for Mint in the long run and right now in Celena we can't afford to add the Update Manager even though mintUpdate is not ready.

By installing the Update Manager:
- You will get asked to upgrade to Gutsy when Gutsy comes out.
- You will be exposed to kernel upgrades and other risky stuff by the click of a single button.

It's fine if you know what you're doing (and you probably do if you go and install these yourself) but it's definitely an experience we want to avoid for novice users.

Clem

Husse · Post by **Husse** » Sun Sep 30, 2007 7:58 am

I see this in the post by KrazyPenguin

Users will still be able to upgrade to the next release:
sudo aptitude dist-upgrade

This is just something never to be done in Mint as it will update the Ubuntu base not Mint
As clem states

By installing the Update Manager:
- You will get asked to upgrade to Gutsy when Gutsy comes out.