MIME-Version: 1.0
References: <O74GIpz--B-9@tuta.io> <D4ACWC7305LF.2DM29SENIP4GF@riseup.net>
In-Reply-To: <D4ACWC7305LF.2DM29SENIP4GF@riseup.net>
Reply-To: noloader@gmail.com
From: Jeffrey Walton <noloader@gmail.com>
Date: Thu, 19 Sep 2024 11:41:55 -0400
Message-ID: <CAH8yC8nshCNg5S0PqbndjDvLjow5wSi3BmTwDnv0yrg8bZGJ1w@mail.gmail.com>
Subject: Re: Discussion - Is Alpine Linux still a more secure Linux
 Distribution compared to its compatriots
To: REDACTED <palisade@riseup.net>
Cc: kdmw.629@tuta.io, "~alpine/users" <~alpine/users@lists.alpinelinux.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 19, 2024 at 11:13=E2=80=AFAM REDACTED <palisade@riseup.net> wro=
te:
>
> On Wed Sep 18, 2024 at 6:38 AM PDT,  wrote:
> > So the point of discussion is, does Alpine still offer in terms of
> > security that the other distros dont? Or have the other distros caught
> > up with Alpine Linux? Should Alpine be considered as more secure or
> > equal secure compared to its peers like Debian, Ubuntu, Fedora, etc?
>
> [...]
> Whether Alpine is doing, or will do something comes down to some basics:
> does it make sense for Alpine (ie, fit for small systems), can it be
> merged in a way that doesn't disrupt what people have running, who's
> going to do the work, and can it be sustained.
>
> Alpine has its opinions in how it's composed. For instance, busybox and
> musl and openrc. Tradeoffs!  Smaller surface and less complex, but fewer
> eyeballs. On the one hand, we're probably not going to be affected by
> vulns in glibc, systemd, and so forth. A smaller codebase with a much
> lower rate of upstream change than other distros *should* yield a less
> vulnerable base. But this is hypothetical: all software has bugs one way
> or another, that is the real world.

One datapoint from my $dayjob... Alpine is used for container
instances because it has a small footprint, and it is best-in-class
with respect to vulnerability scanner results. I.e., it has the fewest
findings from known exploits. This is compared with other popular
distros like Debian and Ubuntu.

However, I have not seen a comparison of Alpine and Fedora. I've asked
SecDevOps to perform the Fedora scan for comparison, but it has not
happened. And I have also not seen a comparison with a distro running
gresecurity patches, like Gentoo.

The dev teams don't always like Alpine because it is often missing
Python packages they need. The devs complain they have to
build/install/package what they need.

Jeff