<!doctype html><htmllang=endir=auto><head><metacharset=utf-8><metahttp-equiv=x-ua-compatiblecontent="IE=edge"><metaname=viewportcontent="width=device-width,initial-scale=1,shrink-to-fit=no"><metaname=robotscontent="index, follow"><title>Choosing Your Desktop Linux Distribution | PrivSec.dev</title><metaname=keywordscontent="operating system,security,linux"><metaname=descriptioncontent="NotallLinuxdistributionsarecreatedequal.WhenchoosingaLinuxdistribution,thereareseveralthingsyouneedtokeepinmind.
Release cycle You should choose a distribution which stays close to the stable upstream software releases, typically rolling release distributions. This is because frozen release cycle distributions often don’t update package versions and fall behind on security updates.
For frozen distributions, package maintainers are expected to backport patches to fix vulnerabilities (Debian is one such example) rather than bump the software to the “next version” released by the upstream developer."><metaname=authorcontent="Tommy"><linkrel=canonicalhref=https://privsec.dev/os/choosing-your-desktop-linux-distribution/><linkcrossorigin=anonymoushref=/assets/css/stylesheet.8b523f1730c922e314350296d83fd666efa16519ca136320a93df674d00b6325.cssintegrity="sha256-i1I/FzDJIuMUNQKW2D/WZu+hZRnKE2MgqT32dNALYyU="rel="preload stylesheet"as=style><scriptdefercrossorigin=anonymoussrc=/assets/js/highlight.f413e19d0714851f6474e7ee9632408e58ac146fbdbe62747134bea2fa3415e0.jsintegrity="sha256-9BPhnQcUhR9kdOfuljJAjlisFG+9vmJ0cTS+ovo0FeA="onload=hljs.initHighlightingOnLoad()></script>
<linkrel=iconhref=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=icontype=image/pngsizes=16x16href=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=icontype=image/pngsizes=32x32href=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=apple-touch-iconhref=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=mask-iconhref=https://privsec.dev/%3Clink%20/%20abs%20url%3E><metaname=theme-colorcontent="#2e2e33"><metaname=msapplication-TileColorcontent="#2e2e33"><noscript><style>#theme-toggle,.top-link{display:none}</style></noscript><metaproperty="og:title"content="Choosing Your Desktop Linux Distribution"><metaproperty="og:description"content="NotallLinuxdistributionsarecreatedequal.WhenchoosingaLinuxdistribution,thereareseveralthingsyouneedtokeepinmind.
Release cycle You should choose a distribution which stays close to the stable upstream software releases, typically rolling release distributions. This is because frozen release cycle distributions often don’t update package versions and fall behind on security updates.
For frozen distributions, package maintainers are expected to backport patches to fix vulnerabilities (Debian is one such example) rather than bump the software to the “next version” released by the upstream developer."><metaproperty="og:type"content="article"><metaproperty="og:url"content="https://privsec.dev/os/choosing-your-desktop-linux-distribution/"><metaproperty="article:section"content="os"><metaname=twitter:cardcontent="summary"><metaname=twitter:titlecontent="Choosing Your Desktop Linux Distribution"><metaname=twitter:descriptioncontent="NotallLinuxdistributionsarecreatedequal.WhenchoosingaLinuxdistribution,thereareseveralthingsyouneedtokeepinmind.
Release cycle You should choose a distribution which stays close to the stable upstream software releases, typically rolling release distributions. This is because frozen release cycle distributions often don’t update package versions and fall behind on security updates.
For frozen distributions, package maintainers are expected to backport patches to fix vulnerabilities (Debian is one such example) rather than bump the software to the “next version” released by the upstream developer."><scripttype=application/ld+json>{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":2,"name":"Operating Systems","item":"https://privsec.dev/os/"},{"@type":"ListItem","position":3,"name":"Choosing Your Desktop Linux Distribution","item":"https://privsec.dev/os/choosing-your-desktop-linux-distribution/"}]}</script><scripttype=application/ld+json>{"@context":"https://schema.org","@type":"BlogPosting","headline":"ChoosingYourDesktopLinuxDistribution","name":"ChoosingYourDesktopLinuxDistribution","description":"NotallLinuxdistributionsarecreatedequal.WhenchoosingaLinuxdistribution,thereareseveralthingsyouneedtokeepinmind.\nReleasecycleYoushouldchooseadistributionwhichstaysclosetothestableupstreamsoftwarereleases,typicallyrollingreleasedistributions.Thisisbecausefrozenreleasecycledistributionsoftendon’tupdatepackageversionsandfallbehindonsecurityupdates.\nForfrozendistributions,packagemaintainersareexpectedtobackportpatchestofixvulnerabilities(Debianisonesuchexample)ratherthanbumpthesoftwaretothe“nextversion”releasedbytheupstreamdeveloper.","keywords":["operatingsystem","security","linux"],"articleBody":"NotallLinuxdistributionsarecreatedequal.WhenchoosingaLinuxdistribution,thereareseveralthingsyouneedtokeepinmind.\nReleasecycleYoushouldchooseadistributionwhichstaysclosetothestableupstreamsoftwarereleases,typicallyrollingreleasedistributions.Thisisbecausefrozenreleasecycledistributionsoftendon’tupdatepackageversionsandfallbehindonsecurityupdates.\nForfrozendistributions,packagemaintainersareexpectedtobackportpatchestofixvulnerabilities(Debianisonesuchexample)ratherthanbumpthesoftwaretothe“nextversion”releasedbytheupstreamdeveloper.SomesecurityfixesdonotreceiveaCVE(particularlylesspopularsoftware)atallandthereforedonotmakeitintothedistributionwiththispatchingmodel.Asaresultminorsecurityfixesaresometimesheldbackuntilthenextmajorrelease.\nHoldingpackagesbackandapplyinginterimpatchesisgenerallynotagoodidea,asitdivergesfromthewaythedevelopermighthaveintendedthesoftwaretowork.RichardBrownhasapresentationaboutthis:\nTraditionalandAtomicupdatesTraditionally,Linuxdistributionsupdatebysequentiallyupdatingthedesiredpackages.TraditionalupdatessuchasthoseusedinFedora,ArchLinux,andDebianbaseddistributionscanbelessreliableifanerroroccurswhileupdating.\nAtomicupdatingdistributionsapplyupdatesinfullornotatall.Typically,transactionalupdatesystemsarealsoatomic.\nAtransactionalupdatesystemcreatesasnapshotthatismadebeforeandafteranupdateisapplied.Ifanupdatefailsatanytime(perhapsduetoapowerfailure),theupdatecanbeeasilyrolledbacktoa“lastknowngoodstate.\"\nAdamŠamalíkhasapresentationwithrpm-ostreeinaction:\nEvenifyouareworriedaboutthestabilityofthesystembecauseofregularlyupdatedpackages(whichyoushouldn’t),itmakesmoresensetouseasystemwhichyoucansafelyupdateandrollbackinsteadofanoutdateddistributionpartiallymadeupofunreliablebackportpackageswithoutaneasytoactuallyrollbackincasesomethinggoeswronglikeDebian.\nArch-baseddistributionsAcrhLinuxhasveryuptodatepackageswithminimaldownstreampatching.Thatbeingsaid,ArchbaseddistributionsarenotrecommendedforthosenewtoLinux,regardlessofthedistribution.Archdoesnothaveandistributionupdatemechanismfortheunderlyingsoftwarechoices.Asaresultyouhavetostayawarewithcurrenttrendsandadopttechnologiesastheysupersedeolderpracticesonyourown.\nForas