1

Question in short

What are the real life (security) risks of using Ubuntu ESM for personal use (Ubuntu for desktop) and what to look out for in general to keep the system secure? Do I need to do anything special and are there any pitfalls if I want to continue using this version?

More details

I still use Xenial Xerus on my home computer and since it reached its end of life I am using it in ESM mode. For reasons out of scope of this question I would also like to use this specific version until it reaches its final EOL in 2026. I use my home computer for tasks like: browsing, spreadsheet and text editing, dropboxing, ssh-ing, general command line stuff and occasional TeamViewer)

I researched this topic but after quite some time I am still unsure what to read, and how to proceed. I understand that Universe and Multiverse repositories are not maintained anymore when a version reaches this state. But I probably have a bunch of extra programs installed which are coming from these repositories.

On one hand, it seems that security-wise I am good (additional five years of security and stuff), on the other hand I have a strong feeling that I am at serious risk. Probably I have a bunch of preinstalled programs that I don't even know of and they are a risk.

So I am looking for some hints how to basically security audit my system, but I am no system administrator just a regular power user let's say. Should I for example browse through all the packages installed from these repositories and maybe disable/remove them, or install and get updates from PPAs that are maintained? Or this is the job they do at Canonical and it is called 18.04 and 20.04? :-)

Examples

  • Firefox: I didn't have to go very far: my current Firefox version is 88: firefox/xenial-updates,xenial-security,now 88.0+build2-0ubuntu0.16.04.1 amd64 [installed] - This version of Firefox is released almost a year ago, and the current latest release is 97. I am pretty sure there was at least one security issue in Firefox in a year but apologies to Mozilla if I am wrong.
  • SMplayer: According to this site: https://launchpad.net/~rvm/+archive/ubuntu/smplayer they even released a version for 12.04 in 2021, so I can assume a 10 year support can be expected from them for Xenial too. I am currenlty on the latest version.
  • Python 2: Python 2.7.18 was the last Python release of the 2.x branch. apt-list says: python2.7/xenial-updates,xenial-security,now 2.7.12-1ubuntu0~16.04.18 amd64 [installed] - Does ESM mean that if there is a security issue in Python, Canonical fixes it? I would be surprised.
  • Unity: There were no commits in its repository since 2017.

These are just random examples on the top of my head but probably the rabbit hole goes way deeper.

A final thought

Re-reading my post with the examples section I probably answered my own question but I would like to hear other opinions too. Is there a way to use an Ubuntu desktop version for 10 years for real?

Thanks in advance!

tnagy.adam
  • 2,268
  • 2
  • 17
  • 14
  • You could keep your old versions (and your old browser) but you also will miss security updates. You could make your own "retro" version and compile the fixes on your own... You won't get any help from this forum though: click – kanehekili Feb 20 '22 at 20:42
  • Did you read the ESM support notes; you mention firefox which was one of the desktop apps that only receive support via snap package versions (as they are the same for all releases). The deb package is not supported into ESM which was clearly stated. – guiverc Feb 20 '22 at 21:18
  • 4
    In the simplest terms possible, ESM gives more time to upgrade to a newer release giving access to critical updates. This is most relevant for organizations who use Ubuntu for mission critical services. Even for those users it's recommended for all users to upgrade to a supported release as a priority. So your plan to ride ESM until the very end- that's not the purpose of ESM. As a general purpose desktop user, as you've described your use case, ESM isn't really appropriate for your use case. See: https://ubuntu.com/blog/ubuntu-16-04-lts-transitions-to-extended-security-maintenance-esm – Nmath Feb 20 '22 at 21:18
  • 1
    The risks are that you may lose all your data (oops), that you may the the victim of a computer-based crime (extortion, theft), or that you may become an unwitting accomplice (botnet). However, those are ALWAYS the risks. If you have the skills to manage and mitigate those risks yourself, then ESM can likely be safely used...but the phrasing of the question suggests that you may not be ready for that burden. – user535733 Feb 20 '22 at 23:30
  • For example, transitioning from 16.04 to a future 26.04 might simply be too large of a gap for some of your data (oops). We don't know that -- we have not tested it. Nobody has tested it. You will be the tester, trying it without support. – user535733 Feb 20 '22 at 23:49
  • Thanks for the information, I missed the info about Firefox, installed SMplayer from rvm's ppa instead of Universe, but never cared about Python so much.

    These were just random examples though, what I am looking for is a general way to handle the situation.

    So far here are the results:

    • Carefully read the ESM release notes and documentation
    • Using Snaps might help
    • ESM's purpose is not to use a desktop Ubuntu until it ends, but to have a safety net just in case.
     – tnagy.adam Feb 21 '22 at 09:18

  • This process is too much work to handle by one, it is basically not worth it.

  • The user needs to stay up-to date instead of the distribution's vendor

  • It is only safe if the user is fully aware of the system, and knows all its bits and pieces

    • – tnagy.adam Feb 21 '22 at 09:32