Level 1-3 updates good enough? [SOLVED]

[Moem]

A quick check of the recommended security updates for my system includes--among a LOT of others--Perl, Ruby, and Python 3.4.
I do not program, ever, in these languages or dialects.
My time and resources I consider very valuable; therefore there is absolutely no reason for me to update these packages.

At least Python (I don't know about the others) is used by the system itself. So there is absolutely a reason for you to keep it updated.

[Sir Charles]

@RobertService and all

In order to better understand this problematic, I marked Perl for complete removal in Synaptic to see what other programs and/or packages might get affected.

It has an installed size of 685 KB on my system but its removal will also remove 157 other programs and/or packages for a total size of 206 MB.

Among the things to be removed you will find : Clamtk, Digikam, Ksysguard, Tomboy, Soundkonverter, Filelight, mintinstall, mint-meta-core, mintdesktop, gnome-system-tools, and whole lot of lib#%&2.1?*.

Please correct me if I am wrong, but I suppose a lot of those packages are essential for the working of the Mint.

My understanding of the interrelatedness and the complexity of dependency relation of these packages is very limited for not saying inexistent, but as far as I can see there is much more at stake here than just having installed in my system some tools for programming.

I will be grateful for further explanation and clarification.

best regards
Marziano

[Cosmo.]

A quick check of the recommended security updates for my system includes--among a LOT of others--Perl, Ruby, and Python 3.4.
I do not program, ever, in these languages or dialects.

Might be, but others do and you use those programs; e. g. Mint, perhaps Cinnamon. Try to remove those packages (only simulation) and you will see, that your OS will mostly be history. Those packages are not there for developers - the minority of users are developers; they are there, because other crucial packages depend from them.

My time and resources I consider very valuable; therefore there is absolutely no reason for me to update these packages.

Should you ever get affected by security leaks you should again think, why this had happened. You will not only loose time, but possibly also your privacy - nothing, what you can easily restore, if at all.

[jglen490]

Ya know, maybe some of these folks who admit to not knowing it all should listen to the reasoning and understanding of those who do have most of the answers. Programming languages are key to the operation of Linux. Higher level applications such as Firefox, LibreOffice, and others can be safely uninstalled if unused and unwanted. Go ahead, save a few MB; or better yet explore some of those higher programs. You might be surprised.

While there may be some risk to updating some level 4 and 5 packages, that risk is not absolute and in many cases will resolve problems and leave your system in a much better place in terms of security.

Ignore good, reasoned advice at your own peril. But when your old, un-patched Linux box goes belly-up, we'll still be here to help you rebuild and get you going again. And then you will have the experience, and a few more answers.

[RobertService]

What's wrong with this picture?
I say
"...there is absolutely no reason for me to update these packages...";
and then
Marziano said "...but its removal will also remove 157 other programs and/or packages..."; and
Cosmo said "...Try to remove those packages (only simulation) and you will see, that your OS will mostly be history...".

When, and where, did I make any statement regarding the removal of packages in the Update Manager?

A somewhat different problem, and a serious problem of logic is posed by Moem, who says,

"...At least Python (I don't know about the others) is used by the system itself. So there is absolutely a reason for you to keep it updated...".

I must assume that Python, due to its popularity, IS used within MINT. It does not follow, nor does it make any sense, that the operation of MINT Linux depends, for its proper operation on the continued maintenance and upkeep--BY THE USERS--of ANY software which may be used in the development process. If that is indeed the case, then Mint should come with a strong warning to the user that the continued proper operation on Mint depends SOLELY on the user's keeping the relevant packages updated.
I have seen no such warning. Perhaps a moderator can use his/her position to get this needed and very important warning in place.

Warmest regards...

[michael louwe]

https://wiki.ubuntu.com/BasicSecurity

[Moem]

I must assume that Python, due to its popularity, IS used within MINT.

No need to assume; you've just been told as much. But its popularity has nothing to do with that. It's present in a default installation because it is a tool that the system puts to use. For example Python is needed for correctly executing a lot of the tools that configure and update Mint.

It does not follow, nor does it make any sense, that the operation of MINT Linux depends, for its proper operation on the continued maintenance and upkeep--BY THE USERS--of ANY software which may be used in the development process.

The issue here is not that Python may be used in the development process, or by users who want to write software; it's that Python is an active part of the installed system itself. And of course the parts of your system must be maintained by the user, because who else is going to do it?

By the way, can you try not to insult your conversation partners? Telling people their logic is flawed, just because there is something that you are not understanding, comes across as hostile and adding 'warmest regards' doesn't mitigate that.

While it's true that you never mentioned removing these programs, just not updating them, surely it makes sense that since they are necessary and the system depends on them, they must also be kept up to date?

And I don't think that most people need to be told that they need to keep their operating system secure by keeping it up to date. It's pretty much inherent in computer use, and has been so for a very long time.

[Sir Charles]

What's wrong with this picture?
I say
"...there is absolutely no reason for me to update these packages...";
and then
Marziano said "...but its removal will also remove 157 other programs and/or packages..."; and
Cosmo said "...Try to remove those packages (only simulation) and you will see, that your OS will mostly be history...".

When, and where, did I make any statement regarding the removal of packages in the Update Manager?

True, you didn't. My intention was solely to demonstrate how deeply involved (for the sake of an example) Perl is, not only for the functioning of a few
applications, that I can do without, but apparently for the working of the whole system. I never suggested removal of the package in question nor did I imply that you did. But If it is the case that so many other packages, vital for the running of the system, are reliant on one specific package, then by any logic, keeping that specific package updated, make sense to me, if not to you.

[SyncroScales]

Linux Mint Cinnamom 64-bit 18.2 (currently).

catwaesel: Linux LinuxLaptop 4.13.0-26-generic #29~16.04.2-Ubuntu SMP Tue Jan 9 22:00:44 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

I also did not know how important something such as python was for the system. But in some audio/video forums, they may recommend to update or install python for certain programs to work.

From my current experience with Linux and having to install it 5 times so far, I recommend when installing Linux Mint to install it and shut-down. Do the drivers and microcode and shut-down. Reboot and do the level 1-3 updates only and shut-down. Reboot and open Update Manager again, do any more level 1-3 updates then shut-down. Reboot and do the level 4 updates that are checked/highlighted, then shut-down. Reboot and apply the other level 4 updates then shut-down. Reboot and start adding codecs or programs, do 1-5 programs at a time and shut down, reboot and do the updates starting with level 1-3 only.

I added the program Time Shift and plan to do some back-ups. Are there any other imaging programs? Or Time Shift is not an imaging program similar to Norton Ghost?

Since Windows 10 is very invasive and I will have to recommend something else, all information about this topic is good. Making a system build or recommendation to inexperienced computer users will come up soon since Windows 7 and 8/8.1 are going to be unsupported.

What are the chances that if someone only applies level 1-3 updates that a program or Linux will be dependent on a level 4 update and those programs will not work? E.G.: Firefox, Chrome, Chromium, a Terminal, etc? Can Level 4 updates become level 1-3?

[Cosmo.]

Or Time Shift is not an imaging program

No it is not an imaging program, but merely a specialist backup program for the system with the ability to keep several states of the system for restoring.

What are the chances that if someone only applies level 1-3 updates that a program or Linux will be dependent on a level 4 update and those programs will not work? E.G.: Firefox, Chrome, Chromium, a Terminal, etc? Can Level 4 updates become level 1-3?

In short: The chances are zero and the possibility, that a level 4 update will get a level 3 (or above) update does technically exist, but it will near to 100% not happen, because the concept will not allow that. Open the help file of the update manager to read about the concept.

It seems, that you misunderstood the concept of leveling and packaging. A software can depend from other packages, this is independent from the level system. As most programs get released for Ubuntu (the Mint base), the developers do probably not know or not care about the level system. If now a program gets updated, it could be possible, that it might need a higher version of another package. But the update manager does not necessarily offer single packages as updates, but combines packages, which need to updated together (or not at all) as a common update. With this method Mint does ensure, that in case, that you update a level 1 offer you get all, what is needed.

[JoeFootball]

Are there any other imaging programs?

I've used Clonezilla Live for years to make bare metal restore images of my entire hard drive.

Joe

[SyncroScales]

Just to be sure: If a person installed Linux Cinnamon 32-bit or 64-bit Long Term Support (LTS) the day it came out and then installed only Level 1 - 3 updates for the system and programs and chose the option for updates that is easy and keeping it safe to not break the system, Linux should be secure and work? So only level 1 - 3 updates for the system and other programs get installed.

Programs such as Firejail and some browser add-ons would also be added for extra security.

But occasionally a level 4 update for dealing with something such as Spectre and Meltdown (and Intel's problems right now in 2018) might be required which would probably be a level 4?

I chose the intermediate option for updates, so I don't know what happens with the very safe option.

Thank you.

[Sir Charles]

SyncroScales wrote:
...

What you describe is more or less what I do. I do check the 4-5 updates from time to time and if I do a level 4 update, I take them one at the time, reboot after each and let my system run for some time to make sure everything is alright. Very rarely, if ever, I do a level 5 update. Other users surely have other strategies. Would be interesting to see what other people do.

[JoeFootball]

Other users surely have other strategies. Would be interesting to see what other people do.

Speaking for myself, I like to see all of what's available for all levels. Then I select & apply (typically) all updates for Level 1-3, and only Security (indicated by the exclamation point icon) updates for Level 4, and nothing for Level 5.

Also, as I mentioned above, I like to keep bare metal restore images of my entire hard drive with Clonezilla Live. So, if any of the updates cause issues for my system, I simply restore back to the latest disk image I made.

This method gives me the control that I prefer to have over my updates, and the ability to restore back to a previous disposition should I break anything.

Joe

[Sir Charles]

Also, as I mentioned above, I like to keep bare metal restore images of my entire hard drive with Clonezilla Live. So, if any of the updates cause issues for my system, I simply restore back to the latest disk image I made.

This method gives me the control that I prefer to have over my updates, and the ability to restore back to a previous disposition should I break anything.
Joe

This sounds like a very sound approach to me. I'll be doing this from now on. Thank you for sharing