Hi everyone,
Many of us choose Ubuntu LTS because we want a stable system that receives security updates for years. With Ubuntu Pro, that covers Main and Universe, and that’s great. For a server that’s good enough, because of a much smaller software footprint.
I wonder how most of you deal with Multiverse on a desktop system.
You install an LTS release expecting to stay on it for years, but then you realize that packages like VirtualBox, multimedia codecs, GStreamer plugins, Lutris and others may receive no security patches. If you keep that LTS installation for its full lifetime, you’re likely to end up with packages that have accumulated well known and exploitable vulnerabilities.
I feel like it would be better if Multiverse didn’t even exist in its current form, and it definitely shouldn’t be so easy to enable when there are even no warnings or explanations about the consequences.
Info that’s normally/usually communicated in the context is that Multiverse is “maintained by the community.” That sounds way nicer than saying, “Most packages will never ever receive security patches.”
Do you think Snaps and/or Flatpaks are a good solution to this issue? Do you keep track of which packages you have installed from Multiverse, and if so, how? Do you regularly check whether there are known security vulnerabilities affecting the versions you’re running?
Personally, I’m planning to disable Multiverse and replace its packages with upstream repositories where possible (for example, Oracle’s repository for VirtualBox, if I continue using it).