4 ms·

For 99% of fixes, though I'm unsure about the specifics of this one, just having unattended upgrades enabled will do little/nothing to protect you. Installing

For 99% of fixes, though I'm unsure about the specifics of this one, just having unattended upgrades enabled will do little/nothing to protect you. Installing the upgraded package often won't restart the service, meaning you're still running old code, and in the case of libraries, won't restart every process on the system that has loaded the library, meaning you're still running old code...

kikoreis 10y ago
Hey, Ubuntu/Debian contributor here. Actually, 99% is misrepresenting it. Any [well-packaged] service upgraded through unattended-upgrades (nginx included) gets restarted through package hooks. What unattended-upgrades won't help with are: 1. Updates to the kernel 2. Updates to system libraries which services depend on For 1, if you run Ubuntu you now have canonical-livepatch: http://blog.dustinkirkland.com/2016/10/canonical-livepatch.html http://blog.dustinkirkland.com/2016/10/canonical-livepatch.h... 2 remains a problem, and yes, if you're thinking openssl, that's a problem. But you can track what goes into /var/run/reboot-required.pkgs to see it's really not 99% of fixes we're streaming to you. See http://askubuntu.com/questions/775504/does-unattended-upgrades-restart-services-automatically/ http://askubuntu.com/questions/775504/does-unattended-upgrad... for a more complete discussion.