3 ms·

Article said GitLab patched back in April. Safe to say you didn’t deploy these patches? No judgment. I’m paid to make things, not apply patches. This is howeve

Article said GitLab patched back in April. Safe to say you didn’t deploy these patches? No judgment. I’m paid to make things, not apply patches. This is however why I don’t use self-hosted, pros and cons, etc.

charcircuit 5y ago
Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.
- Gigachad 5y ago
  Yes, you are meant to be paying attention to the security news for all tools you self host. That's part of self hosting. If you can't manage that (which is completely fair), then you shouldn't be self hosting.
  - justin_oaks 5y ago
    What's the best way to keep up on security news for a set of tools? I once had a CVE RSS feed, but it was mostly noise even after I filtered it to only tools/libraries we used.
- nightfly 5y ago
  Depending on how you have it installed you could have your package management system automatically install the updates. They aren't always perfect though, I've had at least one Gitlab update that required manually running migrations commands since the ones in the update script failed for some reason. I wouldn't trust doing it automatically. And I'm not sure about gitlab, but their are often mailing lists for security updates for major software packages.
  - buildbuildbuild 5y ago
    Thanks for the productive response. I was using Watchtower in Docker Compose on all instances, but I had it misconfigured. My fault for assuming auto updates were working without verifying, lesson learned.
  - gnramires 5y ago
    I highly recommend debian's auto update feature (works on derivatives): https://www.linode.com/docs/guides/how-to-configure-automated-security-updates-debian/ https://www.linode.com/docs/guides/how-to-configure-automate... I've never had any problems with it, although I just run a couple of servers :). If everyone enabled this one thing I'm sure the Internet would be significantly safer. Obs: You can select security updates only which I believe are unlikely to break anything!
- john_cogs 5y ago
  GitLab team member here. The way to keep up-to-date on critical security updates for GitLab is to sign up for our Security Alerts mailing list: https://about.gitlab.com/company/preference-center/ https://about.gitlab.com/company/preference-center/

charcircuit 5y ago

Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.

Gigachad 5y ago
Yes, you are meant to be paying attention to the security news for all tools you self host. That's part of self hosting. If you can't manage that (which is completely fair), then you shouldn't be self hosting.
- justin_oaks 5y ago
  What's the best way to keep up on security news for a set of tools? I once had a CVE RSS feed, but it was mostly noise even after I filtered it to only tools/libraries we used.
nightfly 5y ago
Depending on how you have it installed you could have your package management system automatically install the updates. They aren't always perfect though, I've had at least one Gitlab update that required manually running migrations commands since the ones in the update script failed for some reason. I wouldn't trust doing it automatically. And I'm not sure about gitlab, but their are often mailing lists for security updates for major software packages.
- buildbuildbuild 5y ago
  Thanks for the productive response. I was using Watchtower in Docker Compose on all instances, but I had it misconfigured. My fault for assuming auto updates were working without verifying, lesson learned.
- gnramires 5y ago
  I highly recommend debian's auto update feature (works on derivatives): https://www.linode.com/docs/guides/how-to-configure-automated-security-updates-debian/ https://www.linode.com/docs/guides/how-to-configure-automate... I've never had any problems with it, although I just run a couple of servers :). If everyone enabled this one thing I'm sure the Internet would be significantly safer. Obs: You can select security updates only which I believe are unlikely to break anything!
john_cogs 5y ago
GitLab team member here. The way to keep up-to-date on critical security updates for GitLab is to sign up for our Security Alerts mailing list: https://about.gitlab.com/company/preference-center/ https://about.gitlab.com/company/preference-center/