0

As I was reading the release notes for Debian Jessie, I came upon these paragraphs:

The Node.js platform is built on top of libv8-3.14, which experiences a high volume of security issues, but there are currently no volunteers within the project or the security team sufficiently interested and willing to spend the large amount of time required to stem those incoming issues.

Unfortunately, this means that libv8-3.14, nodejs, and the associated node-* package ecosystem should not currently be used with untrusted content, such as unsanitized data from the Internet.

In addition, these packages will not receive any security updates during the lifetime of the Jessie release.

I read that as "don't run a web-facing Node.js application on this operating system" but is it really that bad? It seems surprising to me that something as popular as Node.js would basically be warned against because of a lack of libv8 maintainers.

Are Debian recommending that you avoid running any web-facing Node.js service on Debian Jessie, or does it only apply to some more risky kinds of service?

Improve this question

1 Answer 1

Reset to default
2

This is because a stable release of Debian must stick with the feature version of the time when it turns stable.

Debian team clearly states it in their Q&A:

2.2 Are there package upgrades in `stable'?

No new functionality is added to the stable release. Once a Debian version is released and tagged `stable' it will only get security updates. That is, only packages for which a security vulnerability has been found after the release will be upgraded. All the security updates are served through security.debian.org.

To maintain the functional stability, they backport security fix on their own as needed.

Security updates serve one purpose: to supply a fix for a security vulnerability. They are not a method for sneaking additional changes into the stable release without going through normal point release procedure. Consequently, fixes for packages with security issues will not upgrade the software. The Debian Security Team will backport the necessary fixes to the version of the software distributed in `stable' instead.

On the other hand, v8 is known for rapid release cycle. V8 wiki on GitHub says

Roughly every 6 weeks a new major Stable release is done.

It also says

As soon as a new branch is promoted to Stable, we stop maintaining the previous stable branch. This happens every six weeks, so you should be prepared to update at least this often.

Because Jessie was released on April 2015, we had dozen of stable v8 get released. Generally speaking, as time passes by and serveral stable v8 released, it becomes increasingly difficult for Debian team to fix their package. Appearently, they are lacking volunteers to do backport.

You could use it on your risk, but you are explicitly guided not to.

Improve this answer
6
  • Well that kind of sucks. Are we saying that Node.js will always be a problem to run on Debian, because Debian stable wants packages that rarely get updated and libv8 gets updated often?
    – Jez
    Aug 21, 2016 at 10:09
  • 1
    You don't have to bother with package from the distro. Nodejs.org also give us binary for Linux.
    – lefb766
    Aug 21, 2016 at 10:56
  • Interesting, but isn't it generally recommended to avoid installing stuff outside of the package manager if possible?
    – Jez
    Aug 21, 2016 at 10:58
  • Actually it's your choice. /usr/local/ is reserved for that purpose. Of course, you have to do version management on yourself when you do so.
    – lefb766
    Aug 21, 2016 at 11:21
  • Does the Node.js binary come bundled with libv8? If not it would seem to defeat the purpose of avoiding the package manager.
    – Jez
    Aug 21, 2016 at 11:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .