[Security] How does the security of a default install of Mint compare to Ubuntu and Debian? Why choose Mint over Ubuntu?

[Spice]

My question have two parts.

1st part: How does the security of a default install of Mint compare to Ubuntu and Debian?

I've read some disturbing posts regarding default Mint security:

https://www.reddit.com/r/linux/comments ... inux_mint/

https://news.ycombinator.com/item?id=16085953

FUD? Truth? Please help me to see clear! Basically I want a Linux distro that is relatively easy to use and relatively safe - by default. No design decisions are allowed which hinder basic security )for no good reason). These are my rules. Sound like reasonable?

2nd part of my question: why choose Mint over Ubuntu in 2018? The main selling point has been for Mint that it includes some non-free drivers and add-ons like Flash. Which I don't care about; I don't use Flash even on my Windows system. But these non-free add-ons are optional with the current Mint install anyways. I just want a very basic (and relatively secure, don't forget!) system; basically to be able to use the browser via an Ethernet connection, no support for fancy hardware and drivers are needed. Why choose Mint over Ubuntu in 2018? OK, Mint also comes with a new desktop environment called Cinnamon, but I'm an XFCE person. XFCE is equally available for Mint, Ubuntu, and Debian.

I'm also to learn a little more if I decide to go with Debian; let's say if I have to learn twice as much with Debian as with Mint or Ubuntu, than I consider that a fair deal. A little more time investment on my part, in exchange I learn the system better. If I had to learn five times as much with Debian if I were to go with Mint or Ubuntu, I'd definitely choose Mint or Ubuntu. I don't have five times as much for learning Linux.

I'd consider default Mint, default Ubuntu, and default Debian for best community support. So I'd skip LMDE for now, which, I suspect, have the smallest community from all these options. Nor do I see any reason why should I start with that, as a novice.

[ArtGirl]

I wouldn't worry about this. I came over in May and have had no issues with security.

It seems a 'thing' on Reddit to bash Mint. Maybe some don't like how popular it is, or that it brings a lot of new people over to Linux?

Regarding Ubuntu ... when I ran the live usb to see what all the fuss was about, the first thing that appeared was about data collection, then it crashed within a couple of minutes. Look up Canonical and you'll see they are rather dubious about data, privacy etc eg their search bar used to link directly to Amazon. They work with Microsoft in some way too. I don't know all the details, but I would never trust Ubuntu ... only this year they broke motherboards on some computers, with their 17.10 release, which had to be withdrawn and re-released. Even now they're pushing for 2 programs to be installed in their distro which data collect, for 'improvement', which is rather arrogant, considering all the privacy/security clouds that have been around them. Also, for example, the first link you quote:

A lot of people wanted Ubuntu because it is "the distro" for newbies, but then GNOME 3 happened, Unity happened, Ubuntu's lack of privacy, Ubuntu's pissing on the community and so on. Then Mint was a call for these people, just get it and it's as good as Ubuntu should have been if they were still in their 2004 mind.

Also, I read somewhere here that Mint remove any questionable Ubuntu content during their packaging of programs etc.

Having tested out other distros, my conclusions were that many were too complex, or unstable, or had features missing that I needed ... Mint has none of those issues, and there isn't too much to learn if you just want to know your way round the system and use it simply.

[Spice]

Digging deeper: https://lwn.net/Articles/676664/

[sammiev]

You have a choice, use what works for you!
I use everything and test all.
Many great OS out there.

[ArtGirl]

Digging deeper: https://lwn.net/Articles/676664/

There are no claims against Mint for supposed patent issues that I know of, and I'm pretty sure the big corporations would have enjoyed having a go at Mint/Linux ... hasn't happened. This seems to be old grudges and looking for problems.

[smurphos]

Digging deeper: https://lwn.net/Articles/676664/

Old news and haters liking to get a dig in.

Back in 2016 the website suffered a breach leading to a download ISO being tampered with and theft of some forum data. The issue was discovered and resolved within days, communicated to the community and mitigations put in place.

https://blog.linuxmint.com/?p=3001
https://blog.linuxmint.com/?p=3007
viewtopic.php?f=143&t=217298&hilit=breach

The OS itself is based on Ubuntu and benefits from access to exactly the same security updates that Ubuntu gets and Ubuntu security advisories (https://usn.ubuntu.com/) apply equally to Mint as to Ubuntu. That could IMHO be made clearer in official documentation. The team do highlight major security concerns - e.g. viewtopic.php?f=143&t=261288

Mint differs from Ubuntu in that it offers end-users fine grained control over the software update process via the levels system which categorises updates according to how much potential they have to destabilise the system.

Historically default settings for which levels to automatically apply upgrades for arguably encouraged users into poor security practices - this has been resolved over the last couple of iterations (18.2 and 18.3) via a revamp of this system and now the default settings display all security updates front and centre whilst still giving users enough control so they can make system backups etc before installing security updates that could have scope to destabilise the system. I think that achieves the desired balance between security and stability. In Ubuntu and official Ubuntu spins you don't get that control - the updater is install everything at once or don't install anything at all.

[jimallyn]

FUD. Mint is fine.

[Pjotr]

Mint differs from Ubuntu in that it offers end-users fine grained control over the software update process via the levels system which categorises updates according to how much potential they have to destabilise the system.

Exactly. This doesn't decrease security, whilst optimizing stability.

You might find this article interesting, that I've written about Update Manager in Linux Mint:
https://sites.google.com/site/easylinuxtipsproject/20

[Hoser Rob]

Digging deeper: https://lwn.net/Articles/676664/

There are no claims against Mint for supposed patent issues that I know of, and I'm pretty sure the big corporations would have enjoyed having a go at Mint/Linux ... hasn't happened. This seems to be old grudges and looking for problems.

Big corporations don't give a flying frak about Mint and there are no grudges there.

Mint doesn't include nonfree codecs anymore. Anyone who would consider that a deal breaker for Mint probably should not run Linux anyway. It'll drive them nuts.

The update policy is the best reason to choose Mint. There are a distros out there that are technically more secure than Mint but they aren't, because the system isn't being updated propery due to fears of Linux breaking something. Which is a very real fear.

[ArtGirl]

Digging deeper: https://lwn.net/Articles/676664/

There are no claims against Mint for supposed patent issues that I know of, and I'm pretty sure the big corporations would have enjoyed having a go at Mint/Linux ... hasn't happened. This seems to be old grudges and looking for problems.

Big corporations don't give a flying frak about Mint and there are no grudges there.

I'd meant the links being posted are about old issues and grudges, things that people drag up despite things having been fixed.

[JeremyB]

I wouldn't worry about this. I came over in May and have had no issues with security.

It seems a 'thing' on Reddit to bash Mint. Maybe some don't like how popular it is, or that it brings a lot of new people over to Linux?

Regarding Ubuntu ... when I ran the live usb to see what all the fuss was about, the first thing that appeared was about data collection, then it crashed within a couple of minutes. Look up Canonical and you'll see they are rather dubious about data, privacy etc eg their search bar used to link directly to Amazon. They work with Microsoft in some way too. I don't know all the details, but I would never trust Ubuntu ... only this year they broke motherboards on some computers, with their 17.10 release, which had to be withdrawn and re-released. Even now they're pushing for 2 programs to be installed in their distro which data collect, for 'improvement', which is rather arrogant, considering all the privacy/security clouds that have been around them. Also, for example, the first link you quote:

A lot of people wanted Ubuntu because it is "the distro" for newbies, but then GNOME 3 happened, Unity happened, Ubuntu's lack of privacy, Ubuntu's pissing on the community and so on. Then Mint was a call for these people, just get it and it's as good as Ubuntu should have been if they were still in their 2004 mind.

Also, I read somewhere here that Mint remove any questionable Ubuntu content during their packaging of programs etc.

Having tested out other distros, my conclusions were that many were too complex, or unstable, or had features missing that I needed ... Mint has none of those issues, and there isn't too much to learn if you just want to know your way round the system and use it simply.

Was the motherboard issue contained to Ubuntu? Or were other Distro's affected?

I did do some research and found that the problem was introduced in the mainline kernel 4.11 rc1 and wasn't fixed until 4.14 rc1 and a Mint user on IRC claims his Lenovo was bricked over a year ago. A poster on the Lenovo forums posted about BIOS issues and none of their posts ever mentioned Linux. I also think the commit that caused the issue was submitted by Intel IIRC

[ArtGirl]

Was the motherboard issue contained to Ubuntu? Or were other Distro's affected?

I did do some research and found that the problem was introduced in the mainline kernel 4.11 rc1 and wasn't fixed until 4.14 rc1 and a Mint user on IRC claims his Lenovo was bricked over a year ago. A poster on the Lenovo forums posted about BIOS issues and none of their posts ever mentioned Linux. I also think the commit that caused the issue was submitted by Intel IIRC

I really don't know. Just was posting what I've read here and there. I don't go on IRC or research deeper; just notice if various places are saying similar things etc. Ubuntu withdrew 17.10, and re-released, so I took it that there was a significant issue. At least it's not happening any more. But, yes, Intel involvement isn't great.

[smurphos]

Was the motherboard issue contained to Ubuntu? Or were other Distro's affected?

I did do some research and found that the problem was introduced in the mainline kernel 4.11 rc1 and wasn't fixed until 4.14 rc1 and a Mint user on IRC claims his Lenovo was bricked over a year ago. A poster on the Lenovo forums posted about BIOS issues and none of their posts ever mentioned Linux. I also think the commit that caused the issue was submitted by Intel IIRC

I saw similar snippets - specifically https://www.dedoimedo.com/computers/len ... ution.html - where the blogger notes his Levono machine was caught by the issue testing openSuse with an affected kernel months before 17.10 was released.

[AZgl1800]

I have never had a security problem ever on Linux.

I tried a lot of LiveCD previews, and it didn't take me more than a couple of days to zero in on 17.3 Cinnamon a couple years ago.

I am now using 18.3 Cinnamon

[kukamuumuka]

I prefer Mint, because Ubuntu collects data from the user. Debian is good also.
https://www.ubuntu.com/legal/terms-and- ... acy-policy

[Hoser Rob]

I think sometimes people need to be reminded just how secure Linux actually is, shock Web news notwithstanding.

My netbook doesn't get much use at home, it's mostly used for carting around and used in wifi hotspots. I've also used it for distro and DE hopping in the past. There were a couple of times when, after another reinstall, I forgot to turn on the firewall. Once for over a month.

Guess what? I never got hacked. I don't recommend such practices, or letting Linux security lull you into a sense of complacency, but how many milliseconds would it have taken to get malware on a Windows bix in a wifi hotspot with no firewall?

[Spice]

Digging deeper: https://lwn.net/Articles/676664/

There are no claims against Mint for supposed patent issues that I know of, and I'm pretty sure the big corporations would have enjoyed having a go at Mint/Linux ... hasn't happened. This seems to be old grudges and looking for problems.

Big corporations don't give a flying frak about Mint and there are no grudges there.

To quote from the linked article:

Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US.

Let's say I'm a small business and I want to adopt Mint. A use case of a small business is almost the same as the use case of a home user. Except the software has to be 100% compliant. So how can I be sure about it, despite the article's claims?

Mint doesn't include nonfree codecs anymore. Anyone who would consider that a deal breaker for Mint probably should not run Linux anyway. It'll drive them nuts.

Have you tried to install Linux Mint recently? Right on the install screen, you can opt in to install a bunch of nonfree components.

I did not opt in to install the codecs at the install screen, but when I wanted to play a video file, Mint offered me and downloaded some codecs. Frankly, I didn't check if they were free or not; I just clicked OK.

[Spice]

I think sometimes people need to be reminded just how secure Linux actually is, shock Web news notwithstanding.

Presentation: https://www.youtube.com/watch?v=BVOCYFTC_rQ

Slides and discussion: https://news.ycombinator.com/item?id=13577184

Thanks for everyone's feedback so far!

[smurphos]

Have you tried to install Linux Mint recently? Right on the install screen, you can opt in to install a bunch of nonfree components.

I did not opt in to install the codecs at the install screen, but when I wanted to play a video file, Mint offered me and downloaded some codecs. Frankly, I didn't check if they were free or not; I just clicked OK.

I'm pretty sure you need a net connection to install them though as they are not shipped as part of the installation media anymore. Many other distributions do this and I understand that is sufficient to comply with the legalities.