4 ms·

Unlike Windows, you CAN shutdown a service in Linux, update it, and restart it. Uptime gets the system uptime, not a service uptime. And only Kernel and glib

Unlike Windows, you CAN shutdown a service in Linux, update it, and restart it. Uptime gets the *system* uptime, not a service uptime. And only Kernel and glibc require reboots... And with hotpatches, a reboot isn't strictly required either.

cube00 5y ago
I was thinking about the kernel, 65 CVEs so far this year.
- cosmiccatnap 5y ago
  At least they are honest about them unlike windows where we won't find NT kernel vulnerabilities for a decade sometimes and by then it's been widely exploited.
  - delusional 5y ago
    You missed the point. The point was that 65 CVEs mean that you should at least have rebooted your PC 65 times. No judgment on whether that's few or many CVEs.
    - brigade 5y ago
      Unless every single one of those CVEs was actively exploited at the time a fix was committed to the kernel, no. Just no. Even then, no.
    - melissalobos 5y ago
      > you should at least have rebooted your PC 65 times Really not every CVE in the kernel applies to every system and configuration. You can compile the linux kernel in all kinds of different ways and a decent number of security vulnerabilities found in any given year only apply to unusual configurations.
    - antiframe 5y ago
      Not every CVE affects every system. The kernel is modular and most people don't run every module.
    - Beltalowda 5y ago
      Looking at those 65 CVEs[1] and thinking just about the desktop use case (as that's what this is about), none of them really stand out as "zomg update immediately!" A number just aren't applicable at all for most desktop users, and quite a lot of others aren't readily exploitable, and are not cause for a panic update and reboot. [1]: https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=2022&month=0&cweid=0&order=3&trc=65&sha=ba801471883fb757c1345d508c515b19388c67e2 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
    - Karellen 5y ago
      In addition to what others have said, CVSs often come in related groups, and are patched together. It's likely that a single kernel security release will fix multiple related CVEs all at once.
- d0mine 5y ago
  There are KernelCare, Livepatch which enable updates without the need to reboot.
ntauthority 5y ago
You can do the same on Windows, though this isn't done for client editions as they're mostly for interactive use - and on Linux you might run into issues the more complex dbus-y GUI bits you use too. There's even kernel hot patching, although it's exclusive to some cloud server editions as they're a known environment compared to desktop systems.
- WorldMaker 5y ago
  Yeah, it's an interesting relative of the CAP Theorem space, from what I can see of it: In theory Windows has most of the raw engineering tools to do hot-patching similar to Linux. In practice Windows seems to prefer for interactive users a Consistency/Fewer "Partitions" over Availability and shifts that position for server SKUs. Arguably an interactive user is much more likely to have problems with an Inconsistent OS state and see more "weirdness" from partitioning/splits in the OS state than a server app in a (relative) steady state with well known to the OS dependencies.
kllrnohj 5y ago
Ehhh not really. Linux is just generally bad about saying you should reboot when you really should reboot. For example if any of the commonly used libraries (like gtk) are updated, you really really should reboot or you'll get random bugs and glitches. If you're running a server and you can be sure to do a full restart of that service including any other dependencies then sure. But isn't that functionally a reboot anyway? It's not like keeping just the kernel alive meaningfully changes anything. Your services were still interrupted.

Unlike Windows, you CAN shutdown a service in Linux, update it, and restart it. Uptime gets the *system* uptime, not a service uptime. And only Kernel and glib

cube00 5y ago

I was thinking about the kernel, 65 CVEs so far this year.

cosmiccatnap 5y ago
At least they are honest about them unlike windows where we won't find NT kernel vulnerabilities for a decade sometimes and by then it's been widely exploited.
- delusional 5y ago
  You missed the point. The point was that 65 CVEs mean that you should at least have rebooted your PC 65 times. No judgment on whether that's few or many CVEs.
  - brigade 5y ago
    Unless every single one of those CVEs was actively exploited at the time a fix was committed to the kernel, no. Just no. Even then, no.
  - melissalobos 5y ago
    > you should at least have rebooted your PC 65 times Really not every CVE in the kernel applies to every system and configuration. You can compile the linux kernel in all kinds of different ways and a decent number of security vulnerabilities found in any given year only apply to unusual configurations.
  - antiframe 5y ago
    Not every CVE affects every system. The kernel is modular and most people don't run every module.
  - Beltalowda 5y ago
    Looking at those 65 CVEs[1] and thinking just about the desktop use case (as that's what this is about), none of them really stand out as "zomg update immediately!" A number just aren't applicable at all for most desktop users, and quite a lot of others aren't readily exploitable, and are not cause for a panic update and reboot. [1]: https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=2022&month=0&cweid=0&order=3&trc=65&sha=ba801471883fb757c1345d508c515b19388c67e2 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
  - Karellen 5y ago
    In addition to what others have said, CVSs often come in related groups, and are patched together. It's likely that a single kernel security release will fix multiple related CVEs all at once.
d0mine 5y ago
There are KernelCare, Livepatch which enable updates without the need to reboot.

ntauthority 5y ago

You can do the same on Windows, though this isn't done for client editions as they're mostly for interactive use - and on Linux you might run into issues the more complex dbus-y GUI bits you use too. There's even kernel hot patching, although it's exclusive to some cloud server editions as they're a known environment compared to desktop systems.

WorldMaker 5y ago
Yeah, it's an interesting relative of the CAP Theorem space, from what I can see of it: In theory Windows has most of the raw engineering tools to do hot-patching similar to Linux. In practice Windows seems to prefer for interactive users a Consistency/Fewer "Partitions" over Availability and shifts that position for server SKUs. Arguably an interactive user is much more likely to have problems with an Inconsistent OS state and see more "weirdness" from partitioning/splits in the OS state than a server app in a (relative) steady state with well known to the OS dependencies.

kllrnohj 5y ago

Ehhh not really. Linux is just generally bad about saying you should reboot when you really should reboot. For example if any of the commonly used libraries (like gtk) are updated, you really really should reboot or you'll get random bugs and glitches. If you're running a server and you can be sure to do a full restart of that service including any other dependencies then sure. But isn't that functionally a reboot anyway? It's not like keeping just the kernel alive meaningfully changes anything. Your services were still interrupted.