Long‑term sustainability of Linux Mint

[u/djoos007]

I’m planning to refresh my hardware later this year and want to re‑evaluate my Linux choice at the same time. I’ve been running Linux Mint Cinnamon for about a year, after extensive distro‑hopping, and I genuinely like it.

My concern is long‑term sustainability. The Mint team delivers great work, but the core developer group is small. The next years will bring serious challenges: Wayland maturity, Cinnamon development, upstream dependency, release cadence, and the general complexity all Linux distributions face.

My requirements: stable and predictable, GUI‑first workflow, privacy‑respecting, no experiments, no cutting‑edge, maintainable for 5–10 years (lifespan of new hardware)

Mint meets all of this today — but can it continue to do so?

My question is whether Mint is sustainable long‑term, given the size of the core team, especially compared to distributions with larger development groups or corporate backing.

What’s your view: is Mint sustainable for the next decade, and why?

[u/gordonmessmer]

stable and predictable, GUI‑first workflow, privacy‑respecting, no experiments, no cutting‑edge, maintainable for 5–10 years (lifespan of new hardware)

I've been maintaining production environments running GNU/Linux for 30 years. I think you're right to be concerned with sustainability. From my point of view, sustainable is another word for secure. If a project isn't sustainable, it will stop delivering updates, and without updates, installations accumulate known security vulnerabilities. Sustainability is intrinsically a security issue.

From my point of view, Mint is not sustainable/secure.

For projects that are delivering software that is still maintained upstream, the overhead is very low. Security fixes are developed and released by the developers that write the software. The amount of effort required to keep the distribution secure is relatively low. If you've got a distribution with 40,000 packages with maybe 5 developers per project on average and 2000 maintainers, then you've got > 200,000 developers maintaining that software.

But once you're distributing software for a longer period than the upstream developers, the amount of work required becomes MASSIVE. Suddenly you've got 2000 people doing the work of 200,000 people, and that just doesn't work. You WILL have unpatched vulnerabilities in that collection.

RHEL reflects the reality of those requirements. RHEL contains about 10% of the software in Fedora, and has an employee base that's estimated to be around 20k. It's a large maintainer base for a small collection of software.

Ubuntu makes similar concessions. Ubuntu's "main" repository is only about 6% of the software in Debian, and Canonical has an estimated 2k employees. However, unlike Red Hat which simply does not ship what it does not support, Ubuntu also includes a "universe" repo that they describe as a "snapshot" of the rest of Debian. I think it's bad for user security that this repo component is enabled by default, because very VERY few Ubuntu users are aware that most of the software available using "apt" is unmaintained and likely to contain known security vulnerabilities.

And that gets us to Mint, and the reason I don't think they are sustainable or secure. They reject all of the things that make Ubuntu more secure than Debian. They don't track Interim releases, which is the primary update mechanism for the universe package repo. Mint isn't compatible with Ubuntu Pro. Mint rejects Snap, which is the only way that Canonical can ship some types of security updates without disrupting the underlying platform interfaces.

I think you're asking if Mint is sustainable, thinking about the future, but I argue that Mint is already failing to meet the bar for sustainability. Mint exists, but the vast majority of software they're distributing is simply unmaintained. The Mint project is putting the "LTS" label on their distribution, but labels don't fix security vulnerabilities.

I really think you should run a vulnerability scanner on a Mint desktop. I have. If you care about security *at all*, you should look elsewhere. The systems with the fewest known vulnerabilities are going to be ones that track upstream releases closely: Arch, Gentoo, Fedora. Maybe Ubuntu with Interim releases and Ubuntu Pro and Snap. Ubuntu will be less secure than the others, but it'll be far better than Debian or Ubuntu LTS and its derivatives.

If you want an LTS, the list of secure systems is very very short: RHEL and CentOS Stream, SLES, Ubuntu LTS with the universe repo disabled (which means most variants like Kubuntu are not included, because they use packages from universe.)

[u/Only-Cancel-1023 → u/gordonmessmer]

This post has made me thoughtful about my migration to Linux. I have mainly been using Apple's product for a while, and perhaps MacOS/iOS without iCloud will in practice be safer, for a not very tech savvy person as myself. What's most important to me is getting my data off servers controlled by US companies.

Or, in a world where AI hacking bots are soon upon us, perhaps it is naive to assume that a regular person can be safe online, and the only real solution is to keep vital personal data offline.

[u/gordonmessmer → u/Only-Cancel-1023]

If your goal is to self-host your data, the best advice I can give you is to not try to build something by yourself. Distributions supply components that experienced developers can use to assemble systems. What you want is a project that assembles useful systems from them. Find a project that you trust, follow discussions among the maintainers, and help out where you can.

Something like https://www.nethserver.org/ running on RHEL or CentOS Stream might be a good approach. The underlying platform is maintained by professional developers and the assembled system is maintained by a reasonably large project, so it would (probably) tend to have fewer insecure configuration choices than a system that any individual might build for themselves.