3 ms·

If that matters why hasn't the internet exploded yet? Hardly anyone is doing that thing and it seems to not matter. People who panic only when they see $STUPID

If that matters why hasn't the internet exploded yet? Hardly anyone is doing that thing and it seems to not matter. People who panic only when they see $STUPIDLY_NAMED_ISSUE seem fine.

icedchai 5y ago
Unless there's a vulnerability in something internet facing, you can go a very long time without updating anything. So, yes, it doesn't matter... except when it does. I've logged into production systems with multi year uptimes, with updates that haven't been applied in just as long. Many orgs have a if it's not broke, don't fix it policy. Applying needless updates are just as likely to screw something up.
- greedo 5y ago
  Many orgs get breached (or have no way to detect if they've been breached). It depends on both your industry and your risk tolerance. We generally apply every security patch that comes along for RHEL. Application patching is different, it depends on the severity and what the vendor will support. If we can't patch, we try to apply compensating controls to mitigate the risk. And the pride we all used to have with long uptimes is really a poor badge of courage. It shows a misplaced trust in either your security, or the threat model you face. OS security patches (at least for RHEL) pose little risk of breaking applications. In the last 15 years, I've never once had to roll back a security patch from RH.
  - db48x 5y ago
    Security patches can be applied even to the kernel without restarting anything though, so having a high uptime is not mutually exclusive with staying up to date. Of course, you do have to pay extra for live patching.
    - greedo 5y ago
      I'm still leery of ksplice etc. And the cost is a factor too.
      - db48x 5y ago
        /me nods, but it is so very _very_ convenient.
greedo 5y ago
I work for a stodgy company with over $4B under management. In a highly regulated industry where you have to publicly announce breaches. Sure it may not matter to a quick startup where someone is re-inventing Uber for gokarts, or other small industries, but when you have to satisfy auditors and regulators across different jurisdictions, you can't take a laissez faire attitude towards patching and compliance. And considering how many breaches occur on a weekly basis compromising customer PII etc, its foolhardy to say the Internet hasn't exploded yet. It's been in a continual burn for decades.
Sebb767 5y ago
Ransomware incidents are rampant and PII breaches are quite common. Remember Equifax, who lost the PII of basically all adult US citizens? Sure, there are extremely sophisticated, targeted hacks. But those are the minority. There are also hacks where hacker groups accidentally (!) shut down an oil pipeline. The reason the internet hasn't completely burned down is three-fold: - We accepted breaches as something "that just happens" and that "nothing is 100% secure" - which is true, yes, but applied very broadly. - Our operating systems are generally well secured and most exploits are very situational. - The hacker groups (at least most of them) don't put in too much effort either, since they make a very good living of the lowest common denominator.

If that matters why hasn't the internet exploded yet? Hardly anyone is doing that thing and it seems to not matter. People who panic only when they see $STUPIDLY_NAMED_ISSUE seem fine.

icedchai 5y ago

Unless there's a vulnerability in something internet facing, you can go a very long time without updating anything. So, yes, it doesn't matter... except when it does. I've logged into production systems with multi year uptimes, with updates that haven't been applied in just as long. Many orgs have a if it's not broke, don't fix it policy. Applying needless updates are just as likely to screw something up.

greedo 5y ago
Many orgs get breached (or have no way to detect if they've been breached). It depends on both your industry and your risk tolerance. We generally apply every security patch that comes along for RHEL. Application patching is different, it depends on the severity and what the vendor will support. If we can't patch, we try to apply compensating controls to mitigate the risk. And the pride we all used to have with long uptimes is really a poor badge of courage. It shows a misplaced trust in either your security, or the threat model you face. OS security patches (at least for RHEL) pose little risk of breaking applications. In the last 15 years, I've never once had to roll back a security patch from RH.
- db48x 5y ago
  Security patches can be applied even to the kernel without restarting anything though, so having a high uptime is not mutually exclusive with staying up to date. Of course, you do have to pay extra for live patching.
  - greedo 5y ago
    I'm still leery of ksplice etc. And the cost is a factor too.
    - db48x 5y ago
      /me nods, but it is so very _very_ convenient.

greedo 5y ago

I work for a stodgy company with over $4B under management. In a highly regulated industry where you have to publicly announce breaches. Sure it may not matter to a quick startup where someone is re-inventing Uber for gokarts, or other small industries, but when you have to satisfy auditors and regulators across different jurisdictions, you can't take a laissez faire attitude towards patching and compliance. And considering how many breaches occur on a weekly basis compromising customer PII etc, its foolhardy to say the Internet hasn't exploded yet. It's been in a continual burn for decades.

Sebb767 5y ago

Ransomware incidents are rampant and PII breaches are quite common. Remember Equifax, who lost the PII of basically all adult US citizens? Sure, there are extremely sophisticated, targeted hacks. But those are the minority. There are also hacks where hacker groups accidentally (!) shut down an oil pipeline. The reason the internet hasn't completely burned down is three-fold: - We accepted breaches as something "that just happens" and that "nothing is 100% secure" - which is true, yes, but applied very broadly. - Our operating systems are generally well secured and most exploits are very situational. - The hacker groups (at least most of them) don't put in too much effort either, since they make a very good living of the lowest common denominator.