On Mon, 18 May 2026 17:10:57 +0200 Julian Andres Klode <[email protected]>
wrote:
> I'm not keen on touching the acquire code in stable releases given the
> severe regression potential without having said fixes in a stable
> release (whether Debian or Ubuntu) for a couple of months.
I appreciate the concern about regression, but I want to emphasise that
the present situation is already rather serious.
I came across
https://www.reddit.com/r/debian/comments/1ws65v5/problem_when_installing_certain_packages/
today. These posts are a regular occurrence over there. It's not a
particularly high-traffic forum, so one must assume that they are the
tip of an iceberg.
I am less concerned by the inconvenience experienced by users having to
seek out this workaround than by the potentially very large number of
machines out there which just aren't receiving security updates due to
this bug. Posts which turn out to be about this bug seem to present
almost exclusively as difficulty installing a package. Desktop users who
have already installed the software that they need may take a very long
time to notice that no updates are being installed. Server admins could
easily be reassured that updates are still being checked by reading
recent entries in unattended-upgrades.log.
Shouldn't this be treated as a security issue, due to its ability to
prevent other known security issues from being patched?
Ben Morris
