maria-discuss team mailing list archive

[Marc Deslauriers <marc.deslauriers@xxxxxxxxxxxxx>]

On Mon, 2012-02-13 at 10:11 -0600, Robbie Williamson wrote:
> On 02/13/2012 01:20 AM, Eddie Bachle wrote:
> > I would like to say we would still switch, or still heavily consider it
> > for the grains that could be made by using Ubuntu, however
> > realistically, the lack of native MySQL in any OS would be a huge mark
> > against it.  
> 
> FTR, we would not *drop* MySQL support.  Worst case scenario, we'd place
> them in partner, much like we did with sun-java.  The change would be
> that our default/recommended DB would be MariaDB.
> 
> > Also that being said, if the technical concerns are
> > answered adequately for a vast majority of applications and hardware/OS
> > setups, then I would be totally behind switching to a more open source
> > friendly and compatible database software as there would be little love
> > lost between me and MySQL. 
> 
> One thing to note, the primary motivator for this proposal isn't about
> moving to a more "open source friendly" application.  We have genuine
> security concerns/issues with how MySQL handles and publishes their
> security updates.  We can't simply update supported prior Ubuntu
> releases to newer MySQL versions, so we have to backport patches.  Their
> lack of information and access to the bugs addressed makes it *very*
> time consuming and difficult for our security and SRU teams to do this.
>  If we can resolve these issues, then MySQL's future in main looks much
> brighter.

We are unable to determine what the recent MySQL security fixes are due
to lack of details, and unclear commit messages.

The only thing we can do to keep our users secure right now is to push
MySQL 5.5.20 and 5.1.61 to our stable releases, which is less than ideal
for various reasons.

Marc.