<div dir="ltr"><div>Hi John,</div><div><br></div><div>Gosh, this is a long reply. Sorry. It's an email on the list. The LUG is now officially *active*.</div><div><br></div><div>This isn't a dig at you, John, but more a lament that the Ubuntu community has moved on, so fewer people are contributing now. There are a hundred reasons why, but. I only mention a few.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 13 Aug 2024 at 21:23, John Edwards via GLLUG <<a href="mailto:gllug@mailman.lug.org.uk">gllug@mailman.lug.org.uk</a>> wrote:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">But recently we have found that even though packages are within<br>
support in Ubuntu, fixes which have been made by Debian are not<br>
backported.<br></blockquote><div> <br></div><div><div>I've seen this lament a few times.</div><div><br></div></div><div>Note: They weren't backported before, either, on the whole.</div><div><br></div><div>The difference is, that now you're aware of that fact because motd spams you with adverts for Ubuntu Pro.</div><div><br></div><div>You're being deliberately misleading with your words above, and burying the actual truth much further down the email. They may well be 'within support in Ubuntu' but as you know, up until recently Canonical only had a commitment to *some* packages in the repo, the rest (universe) are maintained by the community. Canonical != Ubuntu.</div><div><br></div><div>It's not that they are holding back fixes to packages that were previously available. They simply were not available. Ubuntu Pro is providing updates to packages that previously were not in scope, and so didn't happen.</div><div><br></div><div>Unfortunately, the amount of work to update packages and backport fixes far exceeds the number of open source community members to maintain them. Same as many open source projects these days. </div><div><br></div><div>What's changed is Canonical are offering this (backporting selected fixes) as a paid service to their enterprise customers. Supporting those paying customers by backporting fixes they would never have had before. Canonical is enabling customers to accelerate and focus development effort on packages Canonical would previously not have touched. Like most software companies, if you pay, you get attention. This isn't exactly new.</div><div><br></div><div>They then make that paid work available for free to the Ubuntu community if they enable Ubuntu Pro. </div><div><br></div><div>If Canonical just published the updates immediately, in the clear, where's the motivation for an enterprise to pay them for the fix?</div><div><br></div><div>"Why should we pay you for this security update, you're publishing it in the clear"</div><div>"You're paying us to do the work"</div><div>"We'll wait then"</div><div><br></div><div>The work then doesn't happen, the updates don't exist, and nobody gets them. Everybody loses.</div><div><br></div><div>Paying enterprise customers can hold off their distro upgrades, retain 20.04 or even 18.04, Ubuntu Pro Free Tier users (the majority) get updates they never got before, and those who refuse to sign up for Ubuntu Pro on principle get to bitch about Canonical online. </div><div><br></div><div>What's not to love, everyone's a winner! :) </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
It was a simple fix to do with library dependencies, which had been<br>
already been fixed in Debian months *before* the Ubuntu package was<br>
released:<br>
<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1000034" rel="noreferrer" target="_blank">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1000034</a><br>
<br></blockquote><div><br></div><div>A "simple fix" in one package of thousands. You, me, and countless others will likely say the exact same thing about a hundred different packages. We all have our favourite "surely they can fix this in a minute" bugs. Yet if we all put a patch in Launchpad, and nudged a Canonical or community developer to sponsor, chances are it could be picked up and everyone would benefit.</div><div><br></div><div>The very point of the community. You know this. :)</div><div><br></div><div>I suspect if Ubuntu didn't have so much process, and wasn't so wedded to Launchpad, they might get more drive-by fixes. One can dream :D </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
So we've ended up having to backport packages from Debian, at which<br>
point we thought we may as well use Debian.<br>
<br></blockquote><div><br></div><div>Or, in another timeline, you contribute that work to Ubuntu, and share the workload, like you're asking Canonical to do for free, at their cost?</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Yes, these packages are in the Ubuntu "universe" rather than the<br>
"main" repository and are supposed to be community maintained, but<br>
community users can not upload to the release repositories (only their<br>
own repositories) so most people do not get to see those fixes unless<br>
they carefully read the bug reports, and so end up with broken or<br>
vulnerable software.<br></blockquote><div><br></div><div>No. Members of the community can have ownership of packages in the universe pocket of the repo via "MOTU (Mistresses Of The Universe) and other initiatives. That's been the case forever. Sadly, with numbers dwindling, there's fewer community members on hand to do that work, and an ever increasing number of packages to maintain.</div><div><br></div><div>Here's the package uploaders to the last ~two weeks of changes to the most recent LTS only.</div><div><br></div><div>* <a href="https://lists.ubuntu.com/archives/noble-changes/2024-August/thread.html">https://lists.ubuntu.com/archives/noble-changes/2024-August/thread.html</a><br></div><div><br></div><div>$ lynx <a href="https://lists.ubuntu.com/archives/noble-changes/2024-August/thread.html">https://lists.ubuntu.com/archives/noble-changes/2024-August/thread.html</a> --dump --width 132 | grep "(Accepted)" | rev | cut -d ')' -f 1 | rev | sort | uniq</div><div><br>These (26) people are (probably) indeed paid Canonical employees (to my best guess):</div><div> Aaron Rainbolt<br> Alex Murray<br> Andreas Hasenack<br> Andy Whitcroft<br> Benjamin Drung<br> Brian Murray<br> Chloé 'kajiya' Smith<br> Dave Jones </div><div> Eduardo Barretto</div><div> Evan Caville<br></div><div> Felipe Reyes<br></div><div> Ian Constantin<br></div><div><div><div> Jeremy Bícha</div></div><div> Julian Andres Klode</div><div> Lena Voytek<br></div><div> Leonidas S. Barbosa<br></div><div> Łukasz Zemczak<br> Luci Stanescu<br></div><div> Marc Deslauriers<br> Matthias Klose<br> Michael Hudson-Doyle</div><div> Nathan Pratta Teodosio<br></div><div> Nick Rosbrook<br></div><div><div> Paride Legovini</div></div><div> Simon Chopin<br></div><div> Utkarsh Gupta<br></div><div><br></div></div><div>These (4) are not paid by Canonical, but are able to update packages in universe (and perhaps other specific packages):</div><div> Erich Eickmeyer</div><div> Scarlett Moore<br></div><div> Sudip Mukherjee</div><div> Lukas Rettler<br></div><div><br></div><div>They're volunteering their time - significant amounts of it in the case of Scarlett, to maintain a ton of packages that Canonical are not, and never were on the hook for.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
I'm not sure if this is lack of staff within Canonical or a breakdown<br>
between them and the wider community.<br></blockquote><div><br></div><div>Canonical has the highest number of employees now than it has ever had in the last 20 years. So it's not just numbers of people, I suspect, but their priorities. They will have paid work doing hardware-enabling new machines, backporting patches for OEMs, building packages for partners and all manner of other things to keep the wolf from the door.</div><div><br></div><div>Those engineers have less and less time to take contributions from the community and sponsor them for release. It's very sad. but actually, it's always been the case. When the flood of new patches from the community turns into a trickle, it gets worse because everyone took their eye off the ball.</div><div><br></div><div>I think (throwing back to the OP of this thread) it's at least partly a by-product of community people moving on to other more interesting things. Some will have burned out, others switched distro, may have taken up hardware hacking, died or something else.</div><div><br></div><div>Some enthusiastic contributors have switched to rolling, or faster-releasing platforms like NixOS and Arch. It's a massive motivator to see your contributions picked up quickly, rather than languish in a queue waiting for some lone developer at Canonical to pick them up.</div><div><br></div><div>Something Canonical (and the wider community) has never been good at is recruiting new people to replace those that age out or burn out. So over time the community has atrophied, and very few people stepped up to take their place. Some have, of course, but not enough.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
And to add insult to injury Ubuntu now pridely displays a message at<br>
every login telling you how many packages you have installed for which<br>
you will not get any security updates unless you sign up for Ubuntu<br>
Pro.</blockquote><div><br></div><div>Canonical has never been "allowed" to advertise any paid service whatsoever. Despite Ubuntu Pro not actually being a paid service for the vast majority of users. I have Ubuntu Pro enabled on 8 machines out of my allocation of 50, with no expiry. Never paid a dime, but I have contributed over the years.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
To my mind, the packages are there, the work is already been done,<br>
mostly by people not employed by Canonical, so to release vulnerable<br>
software and not fix it is rather unethical.<br></blockquote><div><br></div><div>How do you solve this problem, exactly? Put them all up in the clear? As I said before, then nobody will pay for them, because they can just enable the repo that contains these fixes and never pay a dime. Someone, somewhere has to pay for this. Just like people pay Debian developers. Indeed, Canonical pays Debian developers, too.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
ps. As a business, the company I work for did used to pay Canonical<br>
for Ubuntu support many years ago. But they don't any more (lack of<br>
quality and poor response times).<br></blockquote><div><br></div><div>I've heard that before too, sadly. </div><div><br></div><div>Okay, everyone can go back to sleep again now.<br><br>Cheers,</div><div>Al. </div></div></div>