5 ms·

For production, yes, use RELEASE.

by assimpleaspossi 9d ago

justin66 9d ago
Yeah, but which one? Also, real businesses use -CURRENT, everybody knows that.
- BoredomIsFun 9d ago
  > Also, real businesses use -CURRENT, everybody knows that. No, not really.
  - drewg123 9d ago
    I have thousands of CDN servers that would disagree with you. https://people.freebsd.org/~gallatin/talks/OpenFest2023.pdf https://people.freebsd.org/~gallatin/talks/OpenFest2023.pdf
    - BoredomIsFun 9d ago
      Netflix is just a single point. I'd never run current in production.
      - icedchai 9d ago
        It may be more common than you think. The latest version of pfSense CE is on 16.0-CURRENT.
        CursedSilicon 8d ago
        PFsense gleefully ships vulnerable code to their own customers. They are an even worse data point https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
    - cperciva 8d ago
      -CURRENT is great for cattle. For pets, I recommend -RELEASE.
    - crest 8d ago
      A CDN *cache* server is a special case. Netflix cache appliances can accept the risk of running FreeBSD -CURRENT and upgrading half their fleet to the latest snapshot every ~2 weeks and we thank them for battle testing FreeBSD's active development branch in production. It really helps to reveal regressions (both correctness and performance) early in the subsystems and drivers that matter to their usecase. Most users will neither be willing nor able to accept the trade-offs that Netflix chose.
- ArchOversight 9d ago
  14.x-RELEASE if you still need i386 support, 15.x-RELEASE if you are installing new and want the longest longevity.
  - justin66 8d ago
    Nobody is running i386 in production, I would think. It’s fun to imagine someone actually might be…
    - ArchOversight 6d ago
      I know a ton of embedded shops that are running x86 (including some actual i386 still) in production, and will likely for years to come. That stuff was bullet proof, cheap and still runs today. Some of these things have long lifetimes.
adrian_b 9d ago
I cannot imagine any reason why somebody would want to use RELEASE for production. A RELEASE is good for installing FreeBSD on a new computer, or for upgrading from a previous major version of FreeBSD, e.g. from 13 to 14 or from 14 to 15. After installing a RELEASE, you normally update it to STABLE, before starting to use the computer. STABLE versions correspond to the long-term-support versions of Linux, i.e. they include only essential back-ported patches, like security patches or bug fixes. RELEASE are the initial versions, like a Linux x.x.0 version, which may have various problems that are discovered later and corrected in the STABLE versions. I have been running FreeBSD continuously 24/7 on many servers for more than a quarter of century, and I have always used STABLE on them (after installing RELEASE first, especially when upgrading from an older major version, to minimize the risks of incompatibilities).
- cyberpunk 9d ago
  This is not correct, stable is a dev branch, so you’ve been running your 24/7 machines off of unreleased code: “FreeBSD-STABLE is the development branch from which major releases are made.” (https://docs.freebsd.org/en/books/handbook/cutting-edge https://docs.freebsd.org/en/books/handbook/cutting-edge) probably works, but i’m not doing that on my prod thanks. (perhaps you’re thinking of the releng/foo branches instead?)
  - adrian_b 8d ago
    Yes, looking at the current handbook, today you are right and my posting was wrong. However, this is because the policy of FreeBSD has changed. Decades ago, when I started using FreeBSD, STABLE was like I said, the recommended branch for production and frequently it was strictly necessary to update to STABLE because it had important patches missing in RELEASE. It appears that they have changed this some years ago. However, I was oblivious to this, because it did not affect me as I do not track automatically their STABLE versions, but I do only some audited updates.
    - crest 8d ago
      If you run the latest (laptop) hardware you may still have to track stable or backport some patches from -CURRENT.

For production, yes, use RELEASE.

justin66 9d ago

Yeah, but which one? Also, real businesses use -CURRENT, everybody knows that.

BoredomIsFun 9d ago
> Also, real businesses use -CURRENT, everybody knows that. No, not really.
- drewg123 9d ago
  I have thousands of CDN servers that would disagree with you. https://people.freebsd.org/~gallatin/talks/OpenFest2023.pdf https://people.freebsd.org/~gallatin/talks/OpenFest2023.pdf
  - BoredomIsFun 9d ago
    Netflix is just a single point. I'd never run current in production.
    - icedchai 9d ago
      It may be more common than you think. The latest version of pfSense CE is on 16.0-CURRENT.
      - CursedSilicon 8d ago
        PFsense gleefully ships vulnerable code to their own customers. They are an even worse data point https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
  - cperciva 8d ago
    -CURRENT is great for cattle. For pets, I recommend -RELEASE.
  - crest 8d ago
    A CDN *cache* server is a special case. Netflix cache appliances can accept the risk of running FreeBSD -CURRENT and upgrading half their fleet to the latest snapshot every ~2 weeks and we thank them for battle testing FreeBSD's active development branch in production. It really helps to reveal regressions (both correctness and performance) early in the subsystems and drivers that matter to their usecase. Most users will neither be willing nor able to accept the trade-offs that Netflix chose.
ArchOversight 9d ago
14.x-RELEASE if you still need i386 support, 15.x-RELEASE if you are installing new and want the longest longevity.
- justin66 8d ago
  Nobody is running i386 in production, I would think. It’s fun to imagine someone actually might be…
  - ArchOversight 6d ago
    I know a ton of embedded shops that are running x86 (including some actual i386 still) in production, and will likely for years to come. That stuff was bullet proof, cheap and still runs today. Some of these things have long lifetimes.

adrian_b 9d ago

I cannot imagine any reason why somebody would want to use RELEASE for production. A RELEASE is good for installing FreeBSD on a new computer, or for upgrading from a previous major version of FreeBSD, e.g. from 13 to 14 or from 14 to 15. After installing a RELEASE, you normally update it to STABLE, before starting to use the computer. STABLE versions correspond to the long-term-support versions of Linux, i.e. they include only essential back-ported patches, like security patches or bug fixes. RELEASE are the initial versions, like a Linux x.x.0 version, which may have various problems that are discovered later and corrected in the STABLE versions. I have been running FreeBSD continuously 24/7 on many servers for more than a quarter of century, and I have always used STABLE on them (after installing RELEASE first, especially when upgrading from an older major version, to minimize the risks of incompatibilities).

cyberpunk 9d ago
This is not correct, stable is a dev branch, so you’ve been running your 24/7 machines off of unreleased code: “FreeBSD-STABLE is the development branch from which major releases are made.” (https://docs.freebsd.org/en/books/handbook/cutting-edge https://docs.freebsd.org/en/books/handbook/cutting-edge) probably works, but i’m not doing that on my prod thanks. (perhaps you’re thinking of the releng/foo branches instead?)
- adrian_b 8d ago
  Yes, looking at the current handbook, today you are right and my posting was wrong. However, this is because the policy of FreeBSD has changed. Decades ago, when I started using FreeBSD, STABLE was like I said, the recommended branch for production and frequently it was strictly necessary to update to STABLE because it had important patches missing in RELEASE. It appears that they have changed this some years ago. However, I was oblivious to this, because it did not affect me as I do not track automatically their STABLE versions, but I do only some audited updates.
  - crest 8d ago
    If you run the latest (laptop) hardware you may still have to track stable or backport some patches from -CURRENT.