33

I've been using MariaDB, "an enhanced, drop-in replacement for MySQL" on my Debian stable servers for years, because of its increased performance.

However I've noticed that it appears to lag with relation to security updates in MySQL; for instance, there's DSA 3229-1 which lists several vulnerabilities, which do not appear to be patched in the Debian stable mariadb package.

Is this a security versus speed tradeoff? Is MariaDB generally behind on security updates or is this just a one-off?

  • I think the question should be moved to DBA StackExchange but I don't know how to propose it. – BuahahaXD Apr 20 '15 at 10:16
39

Maria-DB is not a performance-enhanced MySQL version.

Maria-DB is the forked MySQL version current used in the open-source space. It was forked from MySQL due to mistrust in how Oracle will behave in regard of the original MySQL code. You can see here for more information.

While until version 5.1 both were more or less the same code, by 5.5 this changed significantly. This means that they are now two different (albeit largely compatible) products, so it is not automatic that erratas affecting one (eg: MySQL) are applicables to the other (MariaDB).

  • 1
    The quote is from the MariDB homepage. My saying "its encreased performance" is on my own real-world experience on the specific projects I have used it for. I understand that it has diverged. So you're saying that these CVEs are not [necessarily] relevant to MariaDB because of the divergance? – artfulrobot Apr 20 '15 at 10:50
  • 3
    @artfulrobot It may be that they are not relevant, or that they weren't reported to the Maria-DB maintainers at the same time, as they were to Oracle. Conversely, it might be that some of them were fixed in MariaDB first. – richardb Apr 20 '15 at 10:54
  • 1
    One more consideration: MySQL probably still has the larger user base, which means that it will be more heavily scrutinized. It may take longer for MariaDB vulnerabilities to be discovered than for MySQL. – Kevin Keane Apr 20 '15 at 21:22
  • 1
    @KevinKeane But on the other hand, a smaller userbase means less demand for exploits and less people actively searching for them. These two factors cancel each other out. – Philipp Apr 20 '15 at 23:18
  • 1
    It would seem that if there is a known exploit for MySQL, then the exploit could be tested against MariaDB, and vice versa. It would seem almost irresponsible not to do so. – dotancohen Apr 21 '15 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.