4 ms·

> it never made it into a stable release. True, but... > Based on log data from the CoreOS Linux Update Service roughly 3% of online, auto-upgrading, hosts we

by zymhan 10y ago

> it never made it into a stable release. True, but... > Based on log data from the CoreOS Linux Update Service roughly 3% of online, auto-upgrading, hosts were affected. If hosts are configured to autoupdate to a release, you're treading a fine line if that release could have issues like wide-open SSH access. Though I'd hope that no one is hosting sensitive data on an OS in alpha, that compromise may be used as a jumping-off point for a more serious attack.

jo909 10y ago
I guess having a lot of machines using the newest alpha releases is a double edge sword. It is great to have many users that are able to report bugs early, but then again a security issue like this is actually a somewhat serious issue. I really hope people that use anything of alpha status know what they are in for. Maybe a bug like this every now or then is required to remind people of the inevitable consequences of doing so. According to https://twitter.com/mjg59/status/732221095051296770 https://twitter.com/mjg59/status/732221095051296770 it affected about 1400 machines.
danielweber 10y ago
You shouldn't have anything security-critical on bleeding-edge or alpha, particularly because you are the canary in the coalmine. I like to encourage people to be those canaries, for my own selfish benefit, but they should be careful.