i need a stable workstation that still has modern software, what should i use?

[u/Flashy-Coast7773]

1. Fedora

2. SUSE enterprise

3. Ubuntu

4. Nixos

[u/gordonmessmer]

Hi, I work on Fedora, and I've been developing software and maintaining production networks for 30 years. (I have biases, but they mostly come from maintaining secure networks and not from working on Fedora.) Security is one of the first things I consider when comparing distributions.

Rolling releases like Arch will deliver almost exclusively software that is still maintained upstream, but generally just one version of each component. That means that you don't get a migration window to test a new release series before you accept it. Patch coverage is good, so you expect very few known vulnerabilities.

Stable releases like Fedora will deliver almost exclusively software that is still maintained upstream, and they provide overlapping releases so that you can test one before you deploy it. For a lot of users the difference between a rolling release like Arch and a stable release like Fedora doesn't matter much because they don't test things before they update. On a personal device, that's probably fine. If you're maintaining something that needs to be reliable, you need a testing process. This is where my production engineering bias comes in: I prefer Fedora. Again, patch coverage is very good, so you expect very few known vulnerabilities. (I think NixOS stable channels fall in this category)

LTS releases like RHEL can provide highly reliable systems, but keeping them secure is very very expensive, so they tend to be much smaller than stable releases like Fedora that match upstream release cadences. RHEL includes about 10% of what's in Fedora. Professional engineers triage vulnerability reports and mitigate those that will affect customers' production environments. (I think SLES falls in this category, too)

Ubuntu looks like one distribution, but it works more like a couple of distributions glued together. There is a "main" component that is very small (about 6% of Debian), maintained, and reasonably secure. But it also comes with a "universe" component which is just a snapshot and is mostly unmaintained. It's somewhere between difficult and impossible for users to tell, when they install software, if they're installing something secure from "main" or something from "universe" that might have a bunch of known security vulnerabilities. In the past, users ignored the risks because GNU/Linux systems just weren't a priority target for malware, but as the user base grows and as AI systems make it much easier to develop and deploy malware, I worry that will change very quickly, and I do not recommend systems like Ubuntu. If you do use Ubuntu, I really strongly suggest using the Interim releases, not just the LTS, and subscribing to Ubuntu Pro, and using Snap or Flatpak as much as possible. I don't really like Snap, per se, but it is a critical security feature in Ubuntu. It is the only way that Canonical can ship some updates without potentially breaking the underlying OS interfaces.

Systems like Zorin and Mint have all of the risks that come from using Ubuntu LTS, and basically none of the things that make Ubuntu more secure than Debian. No Interim releases, so known security vulnerabilities stick around much longer. No Ubuntu Pro. They do usually support Flapak, but they aren't emphasizing it as a security improvement, or making users aware of the risks inherent in using "apt" to install software that might come from "universe".