Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Thu, 19 Sep 2024 15:12:50 +0000
Message-Id: <D4ACWC7305LF.2DM29SENIP4GF@riseup.net>
Subject: Re: Discussion - Is Alpine Linux still a more secure Linux
 Distribution compared to its compatriots
From: "REDACTED" <palisade@riseup.net>
To: <kdmw.629@tuta.io>, "~alpine/users"
 <~alpine/users@lists.alpinelinux.org>
References: <O74GIpz--B-9@tuta.io>
In-Reply-To: <O74GIpz--B-9@tuta.io>

On Wed Sep 18, 2024 at 6:38 AM PDT,  wrote:
> So the point of discussion is, does Alpine still offer in terms of
> security that the other distros dont? Or have the other distros caught
> up with Alpine Linux? Should Alpine be considered as more secure or
> equal secure compared to its peers like Debian, Ubuntu, Fedora, etc?=20

It's not the business of distro maintainers to get into these
comparisons. There's plenty of sites and blogs that get into that stuff,
and then you have to decide for yourself whether any of those opinions
matter.

Whether Alpine is doing, or will do something comes down to some basics:
does it make sense for Alpine (ie, fit for small systems), can it be
merged in a way that doesn't disrupt what people have running, who's
going to do the work, and can it be sustained.

Alpine has its opinions in how it's composed. For instance, busybox and
musl and openrc. Tradeoffs!  Smaller surface and less complex, but fewer
eyeballs. On the one hand, we're probably not going to be affected by
vulns in glibc, systemd, and so forth. A smaller codebase with a much
lower rate of upstream change than other distros *should* yield a less
vulnerable base. But this is hypothetical: all software has bugs one way
or another, that is the real world.

It would probably serve you well to dig through Alpine's gitlab. A lot
of the answers you want are almost certainly there, as well as questions
you probably didn't know to ask -- many of those also have answers.

Some things are left open.

For instance, Alpine has not reappointed the security officer position
yet. https://gitlab.alpinelinux.org/alpine/tsc/-/issues/63

Or at least, not according to that issue. How much this matters is
probably "not much" but it may be of interest to you, along with other
things you will discover across the gitlab there.

--