Re: [ossig] Linux security patches - costs and features?

[Seah Hong Yee <hongyee@polyscientific.com.my>]

On Tuesday 30 September 2003 2:27 am, Imran William Smith wrote:
> I'm trying to get an understanding of the different costs and
> ability of different Linuxes (sorry BSD guys) to stay up to date with
> security patches, and also whether they feature any kind
> of 'push' solution so the installation of patches can be
> centralized at one system administrator (unfortunately, end
> users cannot be guaranteed to install security patches regularly).
>
>
> All I know is
>
> Red Hat : USD 60 per year per desktop for RHN for desktop
> 	  Linux, much more for RH ES.  RHN is the ticket to
> 	  guaranteed access to patches.  Another USD 20 per year
> 	  or so (total USD 80 per desk per year) gives you
> 	  remote push technology.  Without paying, you
> 	  are effectively cut off from security updates unless
> 	  you complete frequent questionnaires (and you could
> 	  not expect all end-users to do that).
>
>
> Mandrake : USD 60 per year gives you access to MandrakeClub.
> 	   Not sure if this features push technology for security
> 	   updates.


That is actually not true. Mandrakeclub does provide you with more mirror but 
it doesn't mean you will have no access to mirrors if you are not a member of 
mandrakeclub.  There are plenty of mirrors around for mandrake. I however, 
personally feel that since I like the distribution, I actually pay for the 
membership without ever actually use more than 5% of the service. 

Mandrake update is done through urpmi which if configure properly can download 
patch automatically as and when they become available. However, urpmi will 
not update your kernel unless you configured it specifically to update kernel 
as well. 

Mandrake does come with a GUI for auto-update but it my opinion is a bit 
retarded, the command line urpmi tools is by far more powerful. 

Mandrake has a product life cycle of two years. which means if you have any 
Mandrake more than 2 years, you would need to upgrade.  

Mandrake does give preferential support to paying customer. Corporate Server 
and Multi-network firewall get auto-update built-in when product is shipped. 
But the cheapest corporate server is around 730 euro and MNF cost 1999euro. 
However, you would still be able to get the download version of MNF and 
configure urpmi by hand, in which case update cost is 0. 

>
>
> Debian:	   Free updates.  Not sure about push technology.  Not sure
> 	   who is paying for bandwidth (could set up national
> 	   mirror I suppose, to help..?)    Not sure how quickly
> 	   updates are released, I believe at least as efficiently
> 	   as the corporate Linuxes.
>
>
>
> So in terms of cost, from what I can see, Debian wins.  In terms
> of remote push of security updates, from what I know, Red Hat wins,
> but I'm not sure how the others work.

In therms of cost mandrake can be the same as debian. Debian's apt-get does 
allow auto-update if I am not mistaken. Mandrake CAN get update automatically 
through URPMI. 
>
>
> Can anybody add any more info?
>
> Thanks
> Imran


------------------------------------------------------------
To unsubscribe: send mail to ossig-request@mncc.com.my
with "unsubscribe ossig" in the body of the message