On desktop, if you need proprietary drivers, Ubuntu is easier to set up.
But yes, if debian works for you, I wouldn't use Ubuntu.
Anyway, needing FIPS is something of a niche requirement. Debian or Rocky are very sane choices as a default Linux distribution for general-purpose servers until you run up against special requirements.
It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification.
This isn't relevant to the CVE, but counters the claim that Debian is always a suitable choice of distribution.
presumably they mean meeting fips standards https://en.wikipedia.org/wiki/FIPS_140
>why is FIPS unique to RHEL
its not
>what has FIPS got to do with this CVE?
it doesnt. it is brought up in reply to the comment.
https://packages.debian.org/trixie/openssl-provider-fips
It's just the library, nothing special about the OS.
https://csrc.nist.gov/projects/cryptographic-module-validati...
As far as I know, compliance comes with an external module:
https://openssl-library.org/post/2025-03-11-fips-140-3/
This module seems to be in Debian:
# apt-cache search fips | grep open openssl-provider-fips - Secure Sockets Layer toolkit - cryptographic utility
# dpkg -L openssl-provider-fips /. /usr /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/ossl-modules /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so /usr/share /usr/share/doc /usr/share/doc/openssl-provider-fips /usr/share/doc/openssl-provider-fips/changelog.Debian.gz /usr/share/doc/openssl-provider-fips/changelog.gz /usr/share/doc/openssl-provider-fips/copyright
There seems to be the validation process, which supposedly must run on each machine it is used on.
openssl fipsinstall -out /tmp/configfile.cnf -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so 2>&1 | tee /tmp/result.txt
--
The above are from my notes, and a test run. But I don't see how Redhat is "special" here. If the module loads and cites compliance, you comply.
It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module.
> It's just the library, nothing special about the OS.
If you need validation, then the kernel also need to be validated.
Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse.
I took the lazy Mint route with my most recent machine since I wanted to use it for light gaming with minimal fuss. I'm going to redo it with Nix sometime soon because the value prop simply isn't there and I'd like to try a declaratively-configured distro.
None of which was a good reason to use it on servers. Even if you were familiar with Ubuntu there is very little difference between an Ubuntu server and a Debian one.
Something to keep in mind is that the term "server" covers a wide range from datacenter beasts pulling kilowatts per node to old desktops running headless to Pi Zeroes and repurposed cell phones, and some of those use cases do in fact benefit from access to proprietary drivers and even hacks like NDISWrapper.
Beyond that, I've seen two main reasons to use Ubuntu Server over Debian, and I say this as someone who has administered Ubuntu, Debian, and CentOS systems for years and always chooses Ubuntu or Debian when the options are open.
1. For a while there were commercial software vendors that would release Linux versions only for specific distros, and Ubuntu was on that list a lot more often than Debian, so if you liked Debian-style packaging and wanted to use commercial software there was a reason to use Ubuntu. Zimbra was one of those when I last used it in the late '00s.
2. There was a time where it seemed like every F/OSS project had a PPA which made it really convenient to install on Ubuntu with automatic updates as part of the system package manager while Debian had to manually load .debs or might not have even had a package due to older system libraries. For personal toy servers and "pet" dev servers this is wonderful, obviously far less important for well-managed "cattle" servers.
Docker, Flatpack, and to a much lesser extent Snap have pretty much eliminated these reasons though. My home server is still Ubuntu LTS because it's easier than changing it but when it next gets rebuilt things will be changing a lot. All of my work servers are migrating to Debian, we have one Ubuntu instance remaining that just had its last major service switched away and a bunch of CentOS systems on sites which are getting swapped out whenever our techs happen to visit.
And also plain Debian repositories gaining popularity over PPAs. WeeChat and Synapse (Matrix) both offer one for example.
Christ that was 2008.18 years ago. My Linux 'experiment' is old enough to vote
[edit] omg circa 2006, firefox was still new back then
Ubuntu still has the superior installer by a good margin, but it does sometimes like to crash when run offline. Debian's installer at least has the option to go text only. There is also more work to do after the install is finished on Debian, but since that's a script it's not such a big deal.
The one bit of the Debian installer I dislike the most is how if you aren't online when you do the install you get a completely empty sources.list, and the Debian sources are a lot more complicated than Ubuntu's. Debian's support for third party drivers like nVidia graphics is also more complicated and confusing than Ubuntu's.
That changed when they started heavily promoting Snaps as the next big thing and started putting features and updates behind their enterprise offerings. Basically, they stopped being "Debian, but better." And Debian also made lots of incremental improvements in user-friendliness in that time. Basically, Debian is now pretty much what Ubuntu always promised to be.
They can pay for Debian support! (I’m not 100% sure who they should go to, but e.g. Freexian are doing Extended LTS for Debian [1], so I suppose they could do a regular support contract as well?)
If there’s another option I’m unaware of, I’d love to hear it. Also to be fair, I didn’t evaluate Sid for this, only Stable.
[1] https://docs.oracle.com/en-us/iaas/Content/Compute/Reference...
Anyway you are right, I would have switched already if Debian was available. I guess AlmaLinux could be an option to consider, since I've read in another comment that they've patched ahead of upstream for several vulnerabilities this year.
(But 100% agree this shouldn't be necessary).