On Wednesday 22 October 2003 10:47, Bill Rugolsky Jr. wrote: > I never meant to suggest that production machines should be upgraded > willy-nilly. Of course not. Rather, I was countering the idea that > FC1 Test was somehow wildly unstable. Thanks for your response, and your insight. > As to security updates for four years, I understand your reluctance > to use RHEL because of price sensitivity. But Red Hat suffers from > price sensitivity too -- they need to pay people to backport and QA > patches. That involves personnel, equipment, and cycles. I understand this. The part I don't like is the Fear, Uncertainty and Doubt that Red Hat is currently distributing. I called a salesrep a few days ago for information on whether the RHEL packages could be used after the first year (without renewing) or whether they could be used on additional systems. The answer I got was that Enterprise Linux is almost all open source and that I could use the open source parts of it on multiple systems but the license prohibited me from using it on more than one machine so I'd have to compile everything from source. I was also told that I could use updates only on one machine, but not on any other machine. But he had no idea which portions of the product were open source and which weren't, which to me is an attempt to instill FUD. Either a given package is or isn't open source. And if Red Hat won't tell us which pieces of their packages are and which aren't, then as far as I'm concerned, they've infected the whole package. Since they have more money than I do, I'm certainly not going to test them on this, but I believe it. > Hardware > compatibility evolves, and so it is necessary to keep around hardware > that was in the HCL for that release. (E.g., 440GX mobos, sold in > large quantities by VA Linux and others, have broken APIC behavior.) > It may be that others can provide this service for less money. This > issue has been rehashed repeatedly on this list. Yes, but so far no one has come up and offered the service. I won't; it's not our business model. And it doesn't appear to be anyone else's either. > I'd suggest that if $100K/yr to hire someone to do maintenance on > your systems, including patching and backporting, is too high, then > hosting providers like yourself need to pool your resources to hire > folks to do the work or divide it amongst yourselves. Or find other resources. > The Fedora > Project is a natural rendezvous point, and one would assume that with > a bit of coordination, the task of keeping the major server > applications secure could be divided among a relatively small group, > with individuals with expertise in a particular app, say Apache or > MySQL, taking on maintenance of that package. It may very well be. So far no one has stepped up to the plate, but I'm hopeful that will happen. > Patching is occasionally difficult, but the vast majority of security > fixes are simple backports. The greatest difficulties are when (1) > the upstream app is no longer vulnerable, due to extensive changes, > hence there is nothing to backport, and (2) kernel patching, due to > the heavily patched kernels in common use. One of the goals of > Fedora core is to keep the kernel closer to mainline, and that may > help. I never said I faulted what Fedora is doing, and I don't. I just don't see it as filling my needs, or my cleints' needs. And that was the basis of my original response and my followups. > If you (or your customers) want *guarantees* regarding security > updates, it is going to cost you money; there is no simple way around > that. We know that. I was willing (and I still am willing) to pay the $60 annual per system fee for RHN; it was Red Hat who decided to eliminate that model. Interestingly, there is an option. I don't want to take it, but it's there, it's supported, and I may have to take it. It's called FreeBSD. No, I'm not trying to start a war. I'm NOT trying to badmouth Linux or Red Hat, or the Fedora project. I'm merely disappointed that the promise of Linux has so deteriorated as companies who've made millions of dollars on open source software are now attempting to license it at as high a price as M$, and using as an excuse that they became a public corporation so now have to put their profits first. That's my opinion. No flames accepted onlist; if anyone needs to flame me please do it offlist. Thanks. Jeff -- Jeff Lasman, nobaloney.net, P. O. Box 52672, Riverside, CA 92517 US Professional Internet Services & Support / Consulting / Colocation Our blists address used on lists is for list email only Phone +1 909 324-9706, or see: "http://www.nobaloney.net/contactus.html";
