4 ms·

Is it? Just update everything regularly. Actually now that I think about it, building by yourself might put you at a disadvantage here, as you'd have to rememb

by ttt0 5y ago

Is it? Just update everything regularly. Actually now that I think about it, building by yourself might put you at a disadvantage here, as you'd have to remember to rebuild everything. I'm kinda lazy when it comes to updates so not sure if I like the idea anymore with having to rebuild all the software I built myself lol, but it probably could be solved by also shipping .so versions of libraries.

carlhjerpe 5y ago
Nix will solve this for you in a breeze.
MereInterest 5y ago
Automatic updates are themselves a security risk, which is something that I rarely hear talked about. For example, the FBI's 2015/2016 dispute with Apple about unlocking phones. The FBI's position relied on the fact that Apple was technically capable of making a modified binary, then pushing it to the phones through automatic updates. If Apple were not capable of doing so (e.g. if updates needed to be approved by a logged-in user), then that vector of the FBI's attack wouldn't be possible. I don't have the best solution for it, but the current trend I see on Hacker News of supporting automatic updates everywhere, sometimes without even giving users an opt-out let alone an opt-in, is rather alarming.
- ttt0 5y ago
  I don't argue for automatic updates. It's pretty much whatever we already have, but instead of updating a single library, you'd have to update every package that depends on that library. I'm just throwing ideas around so you should definitely take what I'm saying with a grain of salt. It just would be interesting to see a distro like that and see what the downsides of this solution are. Chances are that there probably already is something like this and I'm just not aware of it and I'm reinventing the wheel.
  - MereInterest 5y ago
    Ah, got it. Sorry, I misinterpreted "update everything regularly" to imply developers forcing automatic updates on every user. I'm in the same boat, as somebody who isn't in the security field. I try to keep up with it, but will occasionally comment on things that I don't understand.
ex_amazon_sde 5y ago
> Is it? Just update everything regularly. On stable production systems? Never. The CIP project https://www.cip-project.org/ https://www.cip-project.org/ aims to backport security fixes to Linux for *25* years after each CIP release. No sensible organization runs bleeding edge OSes on their airplanes, power plants, payment processors, industrial plants...

by ttt0 5y ago

carlhjerpe 5y ago

Nix will solve this for you in a breeze.

MereInterest 5y ago

Automatic updates are themselves a security risk, which is something that I rarely hear talked about. For example, the FBI's 2015/2016 dispute with Apple about unlocking phones. The FBI's position relied on the fact that Apple was technically capable of making a modified binary, then pushing it to the phones through automatic updates. If Apple were not capable of doing so (e.g. if updates needed to be approved by a logged-in user), then that vector of the FBI's attack wouldn't be possible. I don't have the best solution for it, but the current trend I see on Hacker News of supporting automatic updates everywhere, sometimes without even giving users an opt-out let alone an opt-in, is rather alarming.

ttt0 5y ago
I don't argue for automatic updates. It's pretty much whatever we already have, but instead of updating a single library, you'd have to update every package that depends on that library. I'm just throwing ideas around so you should definitely take what I'm saying with a grain of salt. It just would be interesting to see a distro like that and see what the downsides of this solution are. Chances are that there probably already is something like this and I'm just not aware of it and I'm reinventing the wheel.
- MereInterest 5y ago
  Ah, got it. Sorry, I misinterpreted "update everything regularly" to imply developers forcing automatic updates on every user. I'm in the same boat, as somebody who isn't in the security field. I try to keep up with it, but will occasionally comment on things that I don't understand.

ex_amazon_sde 5y ago

> Is it? Just update everything regularly. On stable production systems? Never. The CIP project https://www.cip-project.org/ https://www.cip-project.org/ aims to backport security fixes to Linux for *25* years after each CIP release. No sensible organization runs bleeding edge OSes on their airplanes, power plants, payment processors, industrial plants...