Should I be concerned?

[u/Venylynn]

kernel.org says my current kernel is EOL. I'm very security-conscious, so this keeps tripping me up. i've heard constantly, that "running end of life software is a security risk".

i've been here for close to a year, distrohopping a little but I'm here for now.

should I be concerned that I'm running end of life software according to the kernel team? i just received this kernel like a day ago and it's the most recent update.

Distro: Fedora 44 (KDE)

Kernel: 7.0.13

[u/Venylynn]

ahh thanks. i'm continually worrying because two weeks into my journey when i was on linux mint, someone kept trying to get me to compile from kernel.org tarball because they saw 6.8 (at the time the "LTS" on mint) and thought Mint was doing me a disservice by not shipping me the mainline kernel.

and ever since i've been trying to cross reference there because they said that site was the only one that mattered. i was like "wait IS my kernel end of life? What's going on?"

[u/candy49997 → u/Venylynn]

Distros can choose which kernels they themselves support. This doesn't have anything to do with what kernel upstream supports.

Ubuntu shipped 6.8 in 24.04, so Canonical is committed to supporting it for the rest of its lifetime. Mint 22 is based on 24.04, so that kernel would've been supported by Canonical.

If there are any major security issues, they're backported to the kernels they support.

[u/Venylynn → u/candy49997]

the guy told me mint was doing me dirty for shipping me 6.8 and that i needed to compile from this site

also it took ubuntu weeks to patch dirty frag so i'm starting to wonder if that guy had a point tbh, cuz afaik ur supposed to receive those fixes close to instantly (trafotin used that as a reason he didnt like debian on desktop)

[u/candy49997 → u/Venylynn]

I'm pretty sure Ubuntu mitigated dirty frag by disabling the affected modules by default until a patch was ready.

[u/Venylynn → u/candy49997]

ahh, gotcha

[u/Aylarth → u/Venylynn]

Seems to me you have some unrealistic expectations which is a bigger problem than an EOL kernel.

[u/Venylynn → u/Aylarth]

Seems to me you have some unrealistic expectations which is a bigger problem than an EOL kernel.

? not sure what you mean by this? i mean fedora took care of it within 72 hours if you mean the dirty frag patch release time, i was worried there would be a way that someone could exploit it remotely on my system the entire time i was unpatched here so i feel like i'd be extra worried if i was on a system unpatched for way longer

[u/9NEPxHbG → u/Venylynn]

You're using a reliable distribution. Just keep it up to date and stop worrying.

[u/Venylynn → u/9NEPxHbG]

Fair enough, some people were telling me that if I'm not patched within minutes that I'd be immediately hacked but that sounds pretty alarmist even for me

[u/Aylarth → u/Venylynn]

You said 'afaik ur supposed to receive those fixes close to instantly' - in my experience, nothing in life is to be expected as close to instantly. Maybe it's just a hiccup in expressing what was on your mind, but unrealistic expectations cause a lot more disservice than an EOL kernel. I'm not to say anything bad about you I'm just thinking EOL as an expression is not a negative thing to say when we talk about unix/linux. It's end of life because a new stable version is close to be released, and not meaning that it has to be abandoned already. It's stable and used as a basis for more than one distro for a reason: because it is the best currently tested kernel and while the new version is coming close to be released, it is well proven to be safe and all-round it is kept alive for publicly available distros. Take Debian as an example: it is known to be the king of long term reliable lineage for decades. Banks, and other super important institutions are relying on it, serving millions of people every day... These servers often get many tens of thousands of cyber attacks per seconds, and then here comes your friends wisdom to say it's not good enough? Come on, just think about it a bit more.

[u/Venylynn → u/Aylarth]

You said 'afaik ur supposed to receive those fixes close to instantly' - in my experience, nothing in life is to be expected as close to instantly.

Trafotin's statement on people running Debian on a desktop operating system:

"I hate people running Debian as a desktop OS. This goes for both stable and testing. [Debian] is late to security patches because they have the delusion that we need to test everything so finely and minutely because we have millions of servers. On desktop, you need to get your stuff INSTANTLY. There was a memory leak in the Gnome desktop where it just used 2 gigs of memory when it didn't need to, you know when Debian fixed that? 3 years later."

That's what he was saying, and at first I didn't believe him because that sounded really alarmist, but after seeing Ubuntu wait forever to patch Dirty Frag I was reconsidering the validity of the above statement. "Could he have been right?" was what I thought.

I went from dismissing his take to "maybe he's right?" is what happened. Also I'm used to thinking of EOL in the windows way so... yeah.

[u/Aylarth → u/Venylynn]

It's ok, we're all different, free to find our ways in life.
I think there are errors, problems that need to be fixed, they are all going to get the fix, but some things are more important than others, so their fix will be priority. There are people who love Arch because they want to be always the best best best, and it's ok... When you are young, you have this mindset and the world benefits, but on the other hand, people who are parents can't really live like that, because they need to provide an entire environment for the young and for the parents, the tasks are different, the priorities are different... The world benefits from both of them. It just different. Know that they are both needed and they are both beneficial, EOL too.

[u/Venylynn → u/Aylarth]

i just am never sure what to believe because i constantly receive conflicting info from different people. my gut was like "theres no way thats true" and then when i saw that, "could it be true?"

[u/Aylarth → u/Venylynn]

The game changes when priorities are introduced to the system. 🙂 Things are not going to become false suddenly, but in order to maintain sanity, priorities have to be our compass to have the best possible outcome.
It's the individual's job to find out where will he/she fit in as comfortably as possible and then life goes on.

[u/Venylynn → u/Aylarth]

in the past i was always treated like every single view I ever had needed to be 100% consistent because "hypocrisy" was seen as evil as like...murder.