10 ms·
I always wondered how people got to these uptimes. I have to reboot my linux box at least once ever other week to install updates.
by sagischwarz 11y ago
I always wondered how people got to these uptimes. I have to reboot my linux box at least once ever other week to install updates.
- bcook 11y agoKernel updates probably need a restart (or use kexec), but most other updates only require a service to be restarted, right?
- sagischwarz 11y agoThat's right. But updating everything except the kernel also seems strange.
- krylon 11y agoWell, on Linux distros it is not uncommon for individual packages to be updates as updates become available. So if there is an update to, say, the web server, it is sufficient to restart the web server. On BSD systems, kernel and userland are developed in lock step, so it's usually a good idea to reboot to be sure they are in sync.
- laumars 11y agoUsually you'd be running the same userland daemons on FreeBSD that you might on Linux. Web servers, databases, OpenSSHd, file networking protocols (FTP, SMB, NFS, etc), and so on aren't generally tied to a particular kernel version since ABIs are not subject to frequent changes (it would be very bad if they were). So with that in mind, you can update your userland on FreeBSD without updating your kernel in much the same way as you can do with Linux. Though it is recommended that you update the entire stack on either platform.
- floatboth 11y agoUpdating the FreeBSD base (to the next major release) without updating the kernel is Not a Good Idea. Backward compatibility is there, down to version 4.x, but no one guarantees forward compatibility! Applications will usually work, but the base system will likely break in some places.
- laumars 11y agoYes, but 'freebsd-update' is akin to an 'apt-get dist-upgrade'. Regular updates from 'pkg' or ports should be fine.
- drummer32 11y agoIt's not at all strange. Security updates to publicly-facing services should be applied as fast as possible. Kernel vulnerabilities are a whole different attack surface
- laumars 11y agoKernel vulnerabilities can be combined with user space vulnerabilities. eg a buggy web script might allow an attacker shell access under a restricted UID. The attacker could then use a kernel vulnerability to elevate their permissions to root.
- krylon 11y agoGenerally speaking, yes. Although, if there is an update to glibc, which tends to affect most processes, I tend to reboot the system, anyway. (On Windows, a lot more updates require a reboot, though, because one cannot replace/delete a file that is opened.)
- pjmlp 11y ago> because one cannot replace/delete a file that is opened. Which is a good thing and I bet a model in all other OSes, besides UNIX. UNIX flock model is just flawed. How many times I crashed something just because I rmed a file that was being used.
- joosters 11y agoIf you rm a file that someone else is reading, they can happily keep reading it for as long as they like. It's only when they close the file that the data becomes unavailable.
- pjmlp 11y agoI know how inodes work, thank you. My first UNIX was Xenix. Applications do crash when they make assumptions about those files. For example, when they are composed by multiple parts and give the filename for further processing via IPC, or have another instance generating a new file with the same name, instead of appending, because the old one is now gone. Another easy way to corrupt files is just to access them, without making use of flock, given its cooperative nature. I surely prefer the OSes that lock files properly, even if it means more work.
- zeveb 11y ago> For example, when they are composed by multiple parts and give the filename for further processing via IPC Of course, the proper way to do this in POSIX is to pass the filehandle. POSIX is actually a pretty cool standard; the sad thing is that one doesn't often see good examples of its capabilities being used to their full extent. For this, I primarily blame C: it's so verbose and has such limited facilities for abstraction that it's often difficult to see the forest for the trees. Combine that with a generation of folks whose knowledge of C dates back to a college course or four, in which efficient POSIX usage may not have been a concern, and one finds good, easy-to-read examples of POSIX harder to find than they really should be.
- krylon 11y agoWell, if one simply does not install updates, it gets rather easy, as long as the hardware does not act up. Which is of course, a really bad idea for the general case. Although it is actually kind of a requirement in some industrial environments, where certifications are involved - once the thing is certified, any change, hardware or software, requires a re-certification, which apparently is expensive and tedious. Which is how many industrial plants, too, end up running on ancient computers, at least by todays's standards.
- sagischwarz 11y agoAn evaluation of the advantages of these kind of certifications compared to not having updates would be interesting (do they really add value, except moving around responsibility?).
- antoinealb 11y agoYou can invert the question: What is the advantage of having updates in most industrial systems?
- sagischwarz 11y agoWell, even systems only connected to local networks or no network at all can still be the target of attacks, like infected flash drives, etc.
- bediger4000 11y agoThat would be a highly interesting evaluation. I worked in the Aerospace/Defense industry in the 1980s, and it seemed to me that "we can't change X, X is 'flight certified'" was a huge excuse for not innovating, or maybe a huge roadblock to innovation. So it's big news in 2016, when Boeing is hinting about stopping 747 production, an aircraft that made its first flight in February of 1969, 46 years before. I'm guessing that "flight certification" is the largest factor in keeping airliner technology in the 1960s.
- 11y ago
- hyperknot 11y agoYou only need to restart when there is a kernel update, and the frequency of kernel updates depend heavily on the distro used. Debian stable, for example, although using ancient versions of the packages, is a great OS for such a use case, as kernel upgrades are really infrequent. Have a look at the changelog frequency of Squeeze [1] or Wheezy [2]. [1] http://metadata.ftp-master.debian.org/changelogs/main/l/linux-latest-2.6/linux-latest-2.6_29_changelog http://metadata.ftp-master.debian.org/changelogs/main/l/linu... [2] http://metadata.ftp-master.debian.org/changelogs/main/l/linux-latest/linux-latest_46_changelog http://metadata.ftp-master.debian.org/changelogs/main/l/linu...
- aroch 11y agoIf you update a central library (e.g. openssl), you'll have to restart in order to deal with in-memory copies being used by other programs. If you're running a Debian server one of the packages to include in your base install is debian-goodies or needrestart because the former bundles a very helpful little script called "checkrestart" and the latter is an updated systemd-compatible version, both of which use `lsof` under the hood to determine when and why package updates require a restart for full effect.
- bgray 11y agoBut do you? You really only need to restart the processes using those packages. Technically, a kernel update (specifically security update, bug fixes may not be important) would only require a reboot.
- jerf 11y agoYes, you can restart all processes using SSL. However, I've often been in situations where I reboot anyhow, because rebooting means I'm 100% confident the old code is gone, whereas if I try to get clever and avoid the restart, I'm significantly less confident. Depending on how hard it is to validate the security bug, that can be a problem. Plus, for much of the past 20 years for many computers, if you're going to restart all services, adding in the last step for rebooting doesn't add all that significantly to the downtime. Server-class hardware often have things that make that not true (stupid RAID cards), but for everything else you were often only adding, say, 25% for the actual reboot.
- dkns 11y agoI managed over 90 days on my PC (ubuntu 14.04) at the office. I would go for more but there was power outage and all my bragging rights are gone.
- sagischwarz 11y agoDo you just omit the reboots after kernel updates? Because on my notebook with 14.04, I have to reboot quite often.
- krylon 11y agoI have a netbook running 12.04 sitting on my nightstand that I use for listening to Podcasts / audiobooks as I go to sleep. I usually wake up after a few hours, put the netbook to sleep, then turn around and go back to sleep. This means I only update the netbook on rare occasions, because when I go to bed, I want to... sleep, you know, not update my netbook. So currently, that thing has about 180 days of uptime (although it spent most of that time sleeping, of course). I have been meaning to install updates and reboot it for months, but during the day, I forget about it, and only think of it as I go to bed... A vicious cycle... ;-) With a kernel update, one doesn't have to reboot, technically, it is merely required for the update to take effect.
- pjc50 11y agoIf the system is suitably firewalled, it's OK to not update regularly. If the system is sufficiently critical, it may be hard to update or migrate it. And if it's still safely working there's no real incentive to do so.
- matthewmacleod 11y ago*If the system is sufficiently critical, it may be hard to update or migrate it. And if it's still safely working there's no real incentive to do so. In the very short term, perhaps. But I'd argue that critical systems are the ones most in need of the ability to be frequently updated and migrated. What's going to happen when a serious security problem demands an immediate change, and you're not prepared for it? Or the system catches fire, or floods? SPOF critical systems are why so many organisations end up in legacy software hell.
- e12e 11y agoYou only need to restart to install kernel updates that you need. While I'd normally just install all updates, most kernel bugs that I recall seeing the past few years are local exploits. If you're running few/no external services, you might not need to upgrade. And often bugs are in little-used subsystems/protocols -- often those will be off-by-default, or turned off by a diligent administrators (never run code you don't need). It's rare to see a kernel-bug that can't be worked around in some way other than patching.
- halviti 11y agoWhile some might disagree, I definitely agree. Often there is no need to install updates at all on machines that only perform one or very few functions that have limited/no network connectivity. Things like HVAC and SCADA systems that only talk to hardware and not the internet, and are physically secured well. I've seen many windows systems with uptimes of several years that have never required any maintenance.
- sagischwarz 11y agoWeren't there a lot of reports in the last few years about how vulnerable SCADA systems are?
- rincebrain 11y agoYes, frequently precisely because one of the two clauses asserted by the previous commenter (a lack of general network connectivity) has become false without changing other things about the workflow. (I'm not advocating for HVAC/SCADA systems to be running, say, Windows XP Embedded with no updates and default passwords, world-facing, just observing that the preconditions changed.)
- Spooky23 11y agoTotally. A lot of industrial/utility type places don't really have robust IT, and they treat computers like industrial equipment. So you may have a factory foreman or operating engineer who is responsible for equipment, who is 100% reliant on a vendor CE for implementing stuff. What ends up happening is that they'll bolt on some network connectivity for convenience or to take on some new process and not set it up appropriately, or not understand what it means to expose something to the LAN or directly to the internet. I helped a friend at a municipal utility with something like this when they wanted to provide telemetry to a city-wide operations center. They had a dedicated LAN/WAN for the SCADA stuff, and the only interface was in this case a web browser running over XWindows that had a dashboard and access to some reports. I think they later replaced it with a Windows RDS box with a similar configuration. Because of the isolation, and professional IT who understood how to isolate the environment, it was advisable to to not be tinkering with updates, as the consequence of failure is risk to health & safety.
- jajern 11y agoOracle Linux can patch the kernel hot. I had some crazy uptimes but had to recently shutdown the hypervisor hosts for some facility updates.
- maaku 11y agoDon't install updates.
- deleted 11y ago[deleted]
- michaelcampbell 11y agoOn a box that does a few specific things, you don't need to install updates.