Date: 2008-03-12 08:04 Subject: Putting a premium on quality? Security: Public

I wrote about this in a comment to Tip of the Day — What MySQL Version to Use by Keith Murphy, but I think it's worthy a separate post and perhaps a little debate. I'm interested to hear what other community members think of this *now*.

Keith noted that he runs builds by Sun-MySQL, since the various distros are often far behind in terms of the MySQL server version they provide. Commenters noted that Debian does backport security fixes, but sticks with older versions. It's also the case that Ubuntu actually uses very recent versions.

I feel that generally, security patches are not the main issue for production servers, since they have no direct external exposure (that may be debatable, and please feel free to comment on this!). While security in this type of environment is not completely unimportant, I feel that fixes for functional problems are much more relevant as they direct affect the application. You’d want to make sure your replication is as stable as possible, even if you have not yet been bitten by a problem that others have reported.

Right now, a key factor is that community builds by Sun-MySQL are only periodic, whereas if you want the latest patches you need to subscribe to MySQL Enterprise or gets the enterprise builds from elsewhere. Is “speed of patches for production use” something that can be charged, or should bugfixes be available quickly to all who use the software? An interesting debate.

While you can make a valid case for the former, I currently lean towards the latter. New features are a different issue again, and we can discuss that later. But with bugfixes, it's not just about providing extra value, it’s about the perceived quality of the overall product and for that the community (and its opinion) is vital. Putting the quality behind a pricetag makes this problematic.... is that really added value, or is it charging for something that the community feels should be theirs anyway? Not that the community is always right in what it feels it should be able to get, but in this case I reckon they may have at least a valid point that merits consideration.

What do you think about this? Note that I'm not debating MySQL Enterprise since that offering involves more than just builds, nor possible alternatives to the current Sun-MySQL build policy and revenue model. I'm not obliged to provide an alternative at this stage; if there's something wrong, it'd be wrong regardless of whether we've already come up with an alternative.
So I merely want to look at this one aspect of putting a premium on bugfixes. Please comment! Thanks