3 ms·
> Configure a cron job or init script to update your system daily. He recommends daily automated updates. This is quite dangerous from my personal experience i
by tutfbhuf 6y ago
> Configure a cron job or init script to update your system daily.
He recommends daily automated updates. This is quite dangerous from my personal experience in various distributions. An update might break your system or might put it into a vulnerable state. I very much prefer regular manual updates, as it allows me to read release notes, bug reports and manual user intervention instructions before update.
- protoman3000 6y ago> I very much prefer regular manual updates, as it allows me to read release notes, bug reports and manual user intervention instructions before update. Do you have the time for this though? > 198 packages need to be updated
- wainstead 6y agoBut, not having the time to review 198 updates shouldn’t justify automatically permitting the updates. I agree there isn’t time to review them, unless you have plenty of staff and time (no one does)... but the recent Solarwinds debacle was a supply chain attack, and automatic updates allowed an exploit to be propagated to many companies and agencies. I would ask myself if I need that many packages. And raise the red flag with management that maintaining proper security is a challenge under such circumstances.
- chris_wot 6y agoHow would reading release notes help in the case of the Solarwinds attack?
- tutfbhuf 6y agoSure, for most (including myself) it's impossible to review every little update. But the bug tracker of your distro is a good indicator if some of the most recent updates created a bunch of new tickets, especially those that are considered to be critical. In case of Arch Linux it is strongly recommended to read the latest update news on archlinux.org, before update. In addition to that you get some experience over time which of your package updates caused most trouble in the past and you can take additional care. For example, I know that on my desktop the combo of displaylink and xorg does break from time to time with updates, therefore I carefully lookout for issues regarding xorg updates for displaylink users, before I do the xorg update.
- midasuni 6y agoYour service should be able to cope with a failure. Just ensure your updates don’t run at the same time on all your services. I have two proxy servers which auto update. One in the morning, one in the evening. If the morning update breaks, it flags up the problem, and we can then fix before the evening one updates.
- tutfbhuf 6y agoSome people only have one server for a particular use case. And servers might not always break in predictable/alertable ways.
- midasuni 6y agoIf your service is only provided by one machine then you have to accept it will occasionally be out of use. If the only monitoring of the service you have are users telling you, then that’s not a problem you can avoid by not updating.
- tutfbhuf 6y ago> If your service is only provided by one machine then you have to accept it will occasionally be out of use. But, I can minimize possible downtimes, by learning from other downtime reports on a bug tracker.
- yjftsjthsd-h 6y agoOkay, I have a server running the database (postgres) that backs my user-facing apps. How exactly shall I run kernel/glibc/systemd/postgres updates without customer-facing outages? EDIT: To be clear, I'm mostly arguing that you're wrong, but if you have a solution then that'd be great, because I dislike the difficulty in patching these things.
- midasuni 6y agoBeen a while since I’ve needed to run a critical database, but the options were generally a master-slave with replication, or an active-active cluster