I obviously haven't been paying enough attention to the news recently. I was completely surpised by the following email:

Thank you for being a Red Hat Network customer.

This e-mail provides you with important information about the upcoming
discontinuation of Red Hat Linux, and resources to assist you with your
migration to another Red Hat solution.

As previously communicated, Red Hat will discontinue maintenance and
errata support for Red Hat Linux 7.1, 7.2, 7.3 and 8.0 as of December
31, 2003. Red Hat will discontinue maintenance and errata support for
Red Hat Linux 9 as of April 30, 2004. Red Hat does not plan to release
another product in the Red Hat Linux line.

I had no idea they were about to do this. From where I'm standing this looks like a very silly step on Redhat's behalf.

I have two Redhat boxes at the moment, one running 7.1 which handles mail and DNS for me a half a dozen friends/family, the other running 9.0 which is purely a remote backup server (rsync copies data to it daily).

I use Redhat because despite the fact that I installed 7.1 a couple of years ago I pay my $60 a year so that I can run "up2date" once a day to keep my security patches up to date. I pay my $60 for both systems.

I also buy a copy of Redhat every 18 months or so.

Now that they have decided to stop updating 7, 8 and 9 they are forcing me to migrate both boxes. I don't have time to scan the web looking for security updates for hundreds of packages, so I need an update service. Hell, I only installed the 9.0 box 4 months ago and come next April updates stop !

So it looks like they are forcing me to either move to Redhat Enterprise to get security updates from them. It looks like I would have to stump up two lots of $379 just to get a two copies of Enterprise and 12 months of update for my two boxes.

I obviously don't want to pay that much...

So I guess I'm going to have to migrate to Debian or something instead ?

The end result for Redhat, no more income from me.

Have I understood this correctly, or have I got the wrong end of the stick ?

If this is true, neither Slashdot nor The Register have noticed yet. I suggest telling them, if only so you can bitch about having an earlier submission when Slashdot actually run the story on Tuesday. And Thursday.

Peter

Someone beat us to it, a Red Hat story just appeared on Slashdot.

Someone beat us to it, a Red Hat story just appeared on Slashdot.

You subscribed to Slashdot? Can't you drink your fill of drivel from this BBS?

Peter

I'm a sucker for punishment...

So I guess I'm going to have to migrate to Debian or something instead ?

All of my boxes run Debian. The only problem that I have with it is this:

It takes too damn long for upgraded packages to appear. The current stable Debian (woody) is still using KDE 2. I'm reluctant to move to the unstable release, or to use backported packages precisely because I need those security updates, and the Debian people don't give such a high priority to security updates on 'unstable' or 'testing'.

I suspect that this is because each version has to be compiled and tested on about 3.5 million different architectures, from the Collossus to Deep Thought. If someone did a Debian variant, with the regular security updates, but only focussed on x86 releases, I suspect that they could include newer packages on a much more timely basis.

They seem to have two customers in mind.
1.The ones that will pay for an enterprise license
2. Everyone else

They expect the former to get enterprise and the latter to start using Fedora.
At least fedora is totally free and will allow updates.

If you can stand the non-ISO download or want to buy the current version, why not give SUSE a try?

I will definitely have to look at Debian, because that sounds like just the sort of approach I actually need. Both my boxes are servers, I'm not interested in having the latest versions of desktop enviroments and the like (because I only ever access them via ssh anyway).

I just want them to keep on working and get updated with critical security patches. I'm assuming Debian stable gets prompt security patches ?

They pretty much acknowledge that they have lost the desktop to SuSE and Mandrake. Can warmly recommend SuSE, unless you want to tinker - then Gentoo is The Thing.

I'm told that Fedora will only have updates for 9 months after each release, which isn't much use to me.

I don't really want to move to anything, I want to continue using RH 7.1 until I need to upgrade. Looks like that isn't an option though.

I'm assuming Debian stable gets prompt security patches ?

Yep. They're usually out extremely quickly after the first public disclosure. I suggest that you subscribe to debian-security-announce for a while to get an idea of when the update announcements are made vs the original vulnerability.

They're easy to apply, too:

# apt-get update
(update the package database with the new version numbers)
# apt-get upgrade
(download and install the new versions)

The one downside is that it's not just desktop packages that are behind. Examine carefully what you actually need, because it might not be in there.

hmmm RedHat acting the same as Microsoft... that's what Linux users get for laughing at us MS-folk when they announced they were suspending NT 4 support.

I've said it many times, and I'll say it again: Gentoo.

Does Gentoo handle security updates well ?

The one downside is that it's not just desktop packages that are behind.

Given that my main Linux box is still running Redhat 7.1 (which I think is about three years old) then that might not be as much of a problem as you think...

Very well, IMHO. Just have to keep up to date with the GLSAs. The one thing they need to add is a GLSA flag for emerge to merge all the GLSA updates only. Maybe that exists already and I just don't know about it.

Does Gentoo handle security updates well ?

Yeah, you just have to write the security fix yourself, patch the source, compile it, and install it yourself.

Oh boy, I'd forgotten how bloody painful taking part in a Slashdot "discussion" is:

http://slashdot.org/comments.pl?sid=84550&cid=7378977

How so many people cannot "get" the idea that I am happy to pay a yearly subscription to have someone make sure I get the relevant security patches, I don't know.

Must remember to leave it a year or two before trying to communicate with the residents of Slashdot again.

Use Freebsd

-Greg

I heard a rumor of ppc emulation coming in x86 netbsd, at which point you could run OS X binaries in emulation on x86. That would be my new choice of platform.

Or OpenBSD.

Only if you want something slow but secure

Funny.

Actually, it's just a matter of running a few commands, usually something like:

emerge sync; emerge -u <package-name>; emerge clean

What if I want to update every package that's currently installed that has an update pending?

emerge sync; emerge -u world

Good practice to run emerge -up world before hand to see what would be done.

See here and here for more information.