3 ms·

In 99% of cases this is efficiently mean that your kernel been upgraded, but it's doesn't affect system usability at all and rarely affect security. I have serv

by SXX 7y ago

In 99% of cases this is efficiently mean that your kernel been upgraded, but it's doesn't affect system usability at all and rarely affect security. I have servers that been continuously upgraded over years, never got single reboot and still function properly.

tsimionescu 7y ago
As far as I know, Linux doesn't support library hotswapping any more than Windows does, so if you have a security update in libc for example, you can either manually restart all programs which use it, or reboot the system. Unless you do one of these, you don't have the security patch up and running, right?
- wokkel 7y ago
  Yes it does but differently: the library is placed on disk and the symlink pointing to the new version is updates. Services depending on this library are restarted. Ssh handles this exceptionally well in that it keeps running sessions open and new sessions use the new library. There is alsof no risk of having locks on files during installation: Unix keeps a gidsen copy of a file until the last process closes it. All in all, almost no reboots required unless a critical kernel bug is found that can be exploited remotely.
  - tsimionescu 7y ago
    Still, each individual process using an updated library needs to be restarted for the update to take effect. The way I see it, Linux does give you much more flexibility in how to deal with these restarts; and the ability to overwrite libraries on disk guarantees you don't get into the horrible Windows update-restart-update-restart cycles: you only ever require one restart at most. However, there are also risks. For one, if you don't restart long-running processes which use updated shared libraries your system may be at risk; also, even if the update was not a vulnerability fix, it is technically possible for processes that communicate through a shared library to misbehave if they have different versions (one using the old library with an old data-structure for example). This probably doesn't happen so much in Linux, where IPC is commonly done through text streams, but may be a much bigger problem on Windows if you update some COM library for example, reducing the usefullness of no-restart updates.

by SXX 7y ago

tsimionescu 7y ago

As far as I know, Linux doesn't support library hotswapping any more than Windows does, so if you have a security update in libc for example, you can either manually restart all programs which use it, or reboot the system. Unless you do one of these, you don't have the security patch up and running, right?

wokkel 7y ago
Yes it does but differently: the library is placed on disk and the symlink pointing to the new version is updates. Services depending on this library are restarted. Ssh handles this exceptionally well in that it keeps running sessions open and new sessions use the new library. There is alsof no risk of having locks on files during installation: Unix keeps a gidsen copy of a file until the last process closes it. All in all, almost no reboots required unless a critical kernel bug is found that can be exploited remotely.
- tsimionescu 7y ago
  Still, each individual process using an updated library needs to be restarted for the update to take effect. The way I see it, Linux does give you much more flexibility in how to deal with these restarts; and the ability to overwrite libraries on disk guarantees you don't get into the horrible Windows update-restart-update-restart cycles: you only ever require one restart at most. However, there are also risks. For one, if you don't restart long-running processes which use updated shared libraries your system may be at risk; also, even if the update was not a vulnerability fix, it is technically possible for processes that communicate through a shared library to misbehave if they have different versions (one using the old library with an old data-structure for example). This probably doesn't happen so much in Linux, where IPC is commonly done through text streams, but may be a much bigger problem on Windows if you update some COM library for example, reducing the usefullness of no-restart updates.