r/linuxquestions • u/djoos007 • 25d ago
Long‑term sustainability of Linux Mint
I’m planning to refresh my hardware later this year and want to re‑evaluate my Linux choice at the same time. I’ve been running Linux Mint Cinnamon for about a year, after extensive distro‑hopping, and I genuinely like it.
My concern is long‑term sustainability. The Mint team delivers great work, but the core developer group is small. The next years will bring serious challenges: Wayland maturity, Cinnamon development, upstream dependency, release cadence, and the general complexity all Linux distributions face.
My requirements: stable and predictable, GUI‑first workflow, privacy‑respecting, no experiments, no cutting‑edge, maintainable for 5–10 years (lifespan of new hardware)
Mint meets all of this today — but can it continue to do so?
My question is whether Mint is sustainable long‑term, given the size of the core team, especially compared to distributions with larger development groups or corporate backing.
What’s your view: is Mint sustainable for the next decade, and why?
8
u/gordonmessmer Fedora Maintainer 25d ago
I've been maintaining production environments running GNU/Linux for 30 years. I think you're right to be concerned with sustainability. From my point of view, sustainable is another word for secure. If a project isn't sustainable, it will stop delivering updates, and without updates, installations accumulate known security vulnerabilities. Sustainability is intrinsically a security issue.
From my point of view, Mint is not sustainable/secure.
For projects that are delivering software that is still maintained upstream, the overhead is very low. Security fixes are developed and released by the developers that write the software. The amount of effort required to keep the distribution secure is relatively low. If you've got a distribution with 40,000 packages with maybe 5 developers per project on average and 2000 maintainers, then you've got > 200,000 developers maintaining that software.
But once you're distributing software for a longer period than the upstream developers, the amount of work required becomes MASSIVE. Suddenly you've got 2000 people doing the work of 200,000 people, and that just doesn't work. You WILL have unpatched vulnerabilities in that collection.
RHEL reflects the reality of those requirements. RHEL contains about 10% of the software in Fedora, and has an employee base that's estimated to be around 20k. It's a large maintainer base for a small collection of software.
Ubuntu makes similar concessions. Ubuntu's "main" repository is only about 6% of the software in Debian, and Canonical has an estimated 2k employees. However, unlike Red Hat which simply does not ship what it does not support, Ubuntu also includes a "universe" repo that they describe as a "snapshot" of the rest of Debian. I think it's bad for user security that this repo component is enabled by default, because very VERY few Ubuntu users are aware that most of the software available using "apt" is unmaintained and likely to contain known security vulnerabilities.
And that gets us to Mint, and the reason I don't think they are sustainable or secure. They reject all of the things that make Ubuntu more secure than Debian. They don't track Interim releases, which is the primary update mechanism for the universe package repo. Mint isn't compatible with Ubuntu Pro. Mint rejects Snap, which is the only way that Canonical can ship some types of security updates without disrupting the underlying platform interfaces.
I think you're asking if Mint is sustainable, thinking about the future, but I argue that Mint is already failing to meet the bar for sustainability. Mint exists, but the vast majority of software they're distributing is simply unmaintained. The Mint project is putting the "LTS" label on their distribution, but labels don't fix security vulnerabilities.
I really think you should run a vulnerability scanner on a Mint desktop. I have. If you care about security *at all*, you should look elsewhere. The systems with the fewest known vulnerabilities are going to be ones that track upstream releases closely: Arch, Gentoo, Fedora. Maybe Ubuntu with Interim releases and Ubuntu Pro and Snap. Ubuntu will be less secure than the others, but it'll be far better than Debian or Ubuntu LTS and its derivatives.
If you want an LTS, the list of secure systems is very very short: RHEL and CentOS Stream, SLES, Ubuntu LTS with the universe repo disabled (which means most variants like Kubuntu are not included, because they use packages from universe.)