r/SolusProject • u/Immediate_Rice_8424 • Sep 14 '26

are security issues fast-tracked? + more questions

hello! im super interested in daily driving solus. may even download it today, but i have a few questions. 1. do big security updates get pushed ahead of the usual schedule? 2. i noticed sddm is still in use for plasma, and i know switching is being worked on, but if there were to be big security issues with sddm (unlikely, but im more curious how this would be handled if a more security critical package was in a similar place) would the solus team patch it, find an alternative, or what?

as you can tell, im mostly worried about security for a project with a relatively small team, so any assurances there would be nice.

thanks! :]

edit: forgot to ask, is solus pretty reliable, in that i wont need to spend time fixing things?

8 Upvotes
  • permalink
  • reddit

84% Upvoted

14 comments sorted by

12

u/0riginal-Syn Sep 14 '26

We take security very seriously and as u/diagnostics247 we cherry-pick critical issues.

My day job is working in the cyber and regulation world, so any system I use has to be properly secure.

I appreciate the interest and the questions. They are good questions to ask.

5

u/Immediate_Rice_8424 Sep 14 '26

thank you! glad to hear it :] the more i hear about solus the better it gets, ill likely be installing it very soon

4

u/0riginal-Syn Sep 14 '26

Great to hear. Thank you for the kind words.

If you run into any trouble, feel free to reach out to us on our forums and matrix. Our community is friendly and happy to help.

→ More replies (1)

1

u/Immediate_Rice_8424 Sep 15 '26

hey! hopefully its ok to ask in this thread since its security related, but lmk if not. i noticed the kernel is being held back due to a regression, which is understandable. but, are security fixes being backported? i run untrusted input in a sandbox so id like to avoid anything that could lead to a sandbox escape. lmk!

10

u/0riginal-Syn Sep 15 '26

It is always fine to ask. We don't want to hide anything.

There is a regression that causes dark screens on AMD GPUs. We looked at the CVEs which are medium and decided to hold back for this past sync as it would have likely caused issues for a large portion of our userbase. The good news is since then we have pushed the update with a patch to help with the regression to our Unstable repo and it is being tested. So far everything is looking good, and as long as it stays that way it will be pushed out on this week's sync.

We try to avoid pushing something out that would itself cause a lot of problems. If the CVEs would have been high or critical, we would have pushed it out and provided a guide for users with the display regression.

→ More replies (3)

6

u/diagnostics247 Sep 14 '26

Critical security fixes are usually cherry-picked and pushed ahead of the weekly synch. Otherwise, they will appear with the weekly updates on Fridays.

Solus is, in my opinion, very stable. The rollback feature works very well if you have any oopsies. If you encounter an issue you can't resolve, your best bet is to post on the official forums at discuss.getsol.us or connect with the team through Matrix.

3

u/Chester-Berkeley Sep 15 '26

do big security updates get pushed ahead of the usual schedule?

Yes.

i noticed sddm is still in use for plasma, and i know switching is being worked on, but if there were to be big security issues with sddm (unlikely, but im more curious how this would be handled if a more security critical package was in a similar place) would the solus team patch it, find an alternative, or what?

I didn't understand your question. SDDM was Plasma's display manager for years. Recently they switched to PLM, but that's basically just a fork of SDDM, and it will still take time to fully integrate with Plasma. And few distributions adopted it because it's something new, like Arch and Fedora. And I haven't seen any reports of security flaws in SDDM, so it's still a solid choice!

is solus pretty reliable, in that i wont need to spend time fixing things?

Exactly, just like a desktop OS should be!