If I want a more secure and up-to-date Linux, in what cases should I avoid the official repositories?

Question

The problem is this: Linux repositories (depending on the distribution) provide software and updates, but usually that software is not the latest official version, but it's an old version or branch that has (hopefully) been patched to fix all (or maybe not all?) the vulnerabilities found so far, and I'm not sure who exactly is doing this and what delay there can be between the disclosure of a vulnerability and the availability of an update in the distribution repositories. I know this is due to a trade-off between security and stability, but I guess sometimes you might feel like having a bit more security rather than stability on a desktop installation.

So that made me wonder: should I install and update Tor using the official repository of my distribution, or should I use another method, and what method? (Like for example using the Tor official repository, which by the way warns you not to use the Ubuntu repos because their Tor package might not be up-to-date, as I suspected, and as I suspect of many other packages, hence this question). And then I asked myself the same question for Virtualbox, VLC, LibreOffice, whatever. By the way, if an application doesn't have an official repository though, it's going to be a pain to check for updates. And I know PPAs shouldn't be considered secure in general.

And that leads to the more general question: if I want a more secure and up-to-date distribution, should I sometimes consider using different methods for installations and updates in place of the official repositories of my distribution? For what kind of packages and applications would you suggest this? This question is especially about desktop installations, but if you want you can also expand your answer including servers, it might be interesting by comparison.

Answer 1

The Tor Project officially recommends you do not use a PPA or your distro's package manager, and instead install directly from their website. This is not usually the case and typically, good package maintainers will keep software up to date. Debian for example releases new security updates for packages promptly and provides public security advisories for vulnerable packages.

It is important to keep track of your distro's public advisories so you can be made aware of the state of your installation and all the relevant packages you have installed. The recent wget vulnerability is reported by Debian as a DSA (Debian Security Advisory), for example.

Answer 2

There's no universal answer, but in general, if you want a more secure system, stick to one of the major distributions, and use a version of the distribution that's maintained. If you want the latest version, bugs and all, then either use a rolling distribution or install the program manually.

For a majority of users, the biggest risk is not doing updates. Sticking to a distribution means that they have a single point of updates. Whether you're a non-technical user or a professional system administrator, it's a lot easier to regularly click a button or run a script to apply the distribution's updates than to check for and apply updates separately for every piece of software you have installed.

You seem to be implicitly assuming that the latest version is the most secure one, but that's wrong! The latest version has new bug fixes, but it also has new bugs, and the security implications of its newer features may be poorly understood. Distributions port security fixes to the version that they ship, so the fact that this is not the latest version does not mean that it has the old vulnerabilities.

In addition, systematically upgrading to the latest version carries the risk that there will be functional incompatibilities, and you'll end up having to choose between suffering from broken functionality due to an upgrade, or keeping the next-to-last version which works for you but has a known vulnerability. Patching the same version you've been using to fix one specific issue carries a lot less risk.

If there's a specific program that you're very keen on, and you absolutely want the latest version, then go ahead and install it. But that's a risk you're taking. It isn't something you do to make your system more secure.

Answer 3

• When a package is not much popular, there will be less chances for it to get vulnerabilities fixed as soon as they are discovered, in distro repositories. However, the official site should have fixed it.

• When the repository you are using is not very popular - it may seem bit absurd. But consider not - so - popular distros with small user base. Thus instead of getting a software application from, say, Tiny Core Linux / Alpine Linux repository is not safer than getting it as a portable tar.gz package or cloning from git then building locally.

//Of course, except the package is installed by 90% of users, you can be ensured that official site of package contains quicker bug fixes, provided that you verify SHA256 checksums after downloading :P.

Answer 4

This is just a cost/gain ratio question. Using a distrib is relying on a third party team to ensure that the different pieces of software that you install on a machine will smoothly run together and will be updated on a regular basis. At the opposite side is the Linux from scratch way: install a kernel and variatious software from their official sources, and directly follow security advices patches and updates. Apart from the risk of mixing incompatible versions, directly following official sources for all installed software will require a lot of work.

My opinion is that the truth should be in the between:

• rely on a distrib for the basic system
• install sensitive parts from their official sources - and do follow security advices

And here comes again the eternal question: what are the threats, what are the risks in my particuliar use case. Once you have answered it, and depending on the distrib you use, on what applications are sensitive for you, and how they are maintained in their official site and in the distrib, you will be able to choose what should come from the distrib and what should come from official sources.

As usual is security, there is no one size fits all solution...