8 ms·

This happened to all Gitlab instances that I manage around 2 days ago. Good to see publicity, I’m still dealing with not-so-understanding abuse departments at m

This happened to all Gitlab instances that I manage around 2 days ago. Good to see publicity, I’m still dealing with not-so-understanding abuse departments at my hosting providers. Sure, my fault for not keeping it up to date. But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host.

SV_BubbleTime 5y ago
Article said GitLab patched back in April. Safe to say you didn’t deploy these patches? No judgment. I’m paid to make things, not apply patches. This is however why I don’t use self-hosted, pros and cons, etc.
- charcircuit 5y ago
  Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.
  - Gigachad 5y ago
    Yes, you are meant to be paying attention to the security news for all tools you self host. That's part of self hosting. If you can't manage that (which is completely fair), then you shouldn't be self hosting.
    - justin_oaks 5y ago
      What's the best way to keep up on security news for a set of tools? I once had a CVE RSS feed, but it was mostly noise even after I filtered it to only tools/libraries we used.
  - nightfly 5y ago
    Depending on how you have it installed you could have your package management system automatically install the updates. They aren't always perfect though, I've had at least one Gitlab update that required manually running migrations commands since the ones in the update script failed for some reason. I wouldn't trust doing it automatically. And I'm not sure about gitlab, but their are often mailing lists for security updates for major software packages.
    - buildbuildbuild 5y ago
      Thanks for the productive response. I was using Watchtower in Docker Compose on all instances, but I had it misconfigured. My fault for assuming auto updates were working without verifying, lesson learned.
    - gnramires 5y ago
      I highly recommend debian's auto update feature (works on derivatives): https://www.linode.com/docs/guides/how-to-configure-automated-security-updates-debian/ https://www.linode.com/docs/guides/how-to-configure-automate... I've never had any problems with it, although I just run a couple of servers :). If everyone enabled this one thing I'm sure the Internet would be significantly safer. Obs: You can select security updates only which I believe are unlikely to break anything!
  - john_cogs 5y ago
    GitLab team member here. The way to keep up-to-date on critical security updates for GitLab is to sign up for our Security Alerts mailing list: https://about.gitlab.com/company/preference-center/ https://about.gitlab.com/company/preference-center/
sofixa 5y ago
Honestly GitLab is so stable and foolproof to update you cn have it autoupdate on a schedule like 1-2 weeks after their monthly eelease.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
Someone1234 5y ago
> But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host. If an organization is too overloaded to patch for six months, maybe they should re-evaluate if self-hosting is the best course of action. Seems like this is a foot-gun of your own creation.
- Gigachad 5y ago
  There is very little reason to even self host Gitlab unless you are insanely paranoid or for philosophy reasons like debian/gnome.
  - pm90 5y ago
    Compliance often forces the hand.
    - deleted 5y ago
      [deleted]
  - sslalready 5y ago
    Reasons for self-hosting: GitLab.com's not-so-great availability [1], slow code searches (compared to self-hosted with GitLab Advanced Search) and the fact that you can keep your code and resources off the public Internet. The fact that you do need to upgrade it yourself regularly is indeed a drawback. On the other hand, an Omnibus upgrade has only failed me twice in the last five years or so, so there's little reason to not do automatic upgrades at night and fire off an alert in case something doesn't work as expected afterwards. Their releases are typically solid, so kudos to the team. [1] https://status.gitlab.com/pages/history/5b36dc6502d06804c08349f7 https://status.gitlab.com/pages/history/5b36dc6502d06804c083...
  - mdoms 5y ago
    Sorry but this comment strikes me as incredibly ignorant. There are lots of good reasons to self host, chief among them reasons which can't be worked around - compliance and data sovereignty.

SV_BubbleTime 5y ago

Article said GitLab patched back in April. Safe to say you didn’t deploy these patches? No judgment. I’m paid to make things, not apply patches. This is however why I don’t use self-hosted, pros and cons, etc.

charcircuit 5y ago
Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.
- Gigachad 5y ago
  Yes, you are meant to be paying attention to the security news for all tools you self host. That's part of self hosting. If you can't manage that (which is completely fair), then you shouldn't be self hosting.
  - justin_oaks 5y ago
    What's the best way to keep up on security news for a set of tools? I once had a CVE RSS feed, but it was mostly noise even after I filtered it to only tools/libraries we used.
- nightfly 5y ago
  Depending on how you have it installed you could have your package management system automatically install the updates. They aren't always perfect though, I've had at least one Gitlab update that required manually running migrations commands since the ones in the update script failed for some reason. I wouldn't trust doing it automatically. And I'm not sure about gitlab, but their are often mailing lists for security updates for major software packages.
  - buildbuildbuild 5y ago
    Thanks for the productive response. I was using Watchtower in Docker Compose on all instances, but I had it misconfigured. My fault for assuming auto updates were working without verifying, lesson learned.
  - gnramires 5y ago
    I highly recommend debian's auto update feature (works on derivatives): https://www.linode.com/docs/guides/how-to-configure-automated-security-updates-debian/ https://www.linode.com/docs/guides/how-to-configure-automate... I've never had any problems with it, although I just run a couple of servers :). If everyone enabled this one thing I'm sure the Internet would be significantly safer. Obs: You can select security updates only which I believe are unlikely to break anything!
- john_cogs 5y ago
  GitLab team member here. The way to keep up-to-date on critical security updates for GitLab is to sign up for our Security Alerts mailing list: https://about.gitlab.com/company/preference-center/ https://about.gitlab.com/company/preference-center/

sofixa 5y ago

Honestly GitLab is so stable and foolproof to update you cn have it autoupdate on a schedule like 1-2 weeks after their monthly eelease.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

Someone1234 5y ago

> But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host. If an organization is too overloaded to patch for six months, maybe they should re-evaluate if self-hosting is the best course of action. Seems like this is a foot-gun of your own creation.

Gigachad 5y ago
There is very little reason to even self host Gitlab unless you are insanely paranoid or for philosophy reasons like debian/gnome.
- pm90 5y ago
  Compliance often forces the hand.
  - deleted 5y ago
    [deleted]
- sslalready 5y ago
  Reasons for self-hosting: GitLab.com's not-so-great availability [1], slow code searches (compared to self-hosted with GitLab Advanced Search) and the fact that you can keep your code and resources off the public Internet. The fact that you do need to upgrade it yourself regularly is indeed a drawback. On the other hand, an Omnibus upgrade has only failed me twice in the last five years or so, so there's little reason to not do automatic upgrades at night and fire off an alert in case something doesn't work as expected afterwards. Their releases are typically solid, so kudos to the team. [1] https://status.gitlab.com/pages/history/5b36dc6502d06804c08349f7 https://status.gitlab.com/pages/history/5b36dc6502d06804c083...
- mdoms 5y ago
  Sorry but this comment strikes me as incredibly ignorant. There are lots of good reasons to self host, chief among them reasons which can't be worked around - compliance and data sovereignty.