6 ms·

I always reinstall from scratch although I could just Debian "dist upgrade". My thinking is this: if, ten years ago, I somehow missed a security patch or some

I always reinstall from scratch although I could just Debian "dist upgrade". My thinking is this: if, ten years ago, I somehow missed a security patch or some 0-day owned my machine before it was patched, then I'd potentially have been copying / dd'ing / rsync'ing a rootkit for ten years. By installing from scratch at every new stable (or unstable) release, I get rid of a lot of potential security issues. Now as an anecdote: ten years with the same install is nice but... I've got a dedicated server at OVH with 3400 days of uptime. You read that correctly. Nearly ten years of uptime. Once in a while I give temporary ssh access to people here and there just so they can type "uptime" and see. Kids: don't try this at home. Yes, it's insecure (although there's a firewall and only the SSH port open). No, it doesn't do much nor is it very useful. But it's fun to think I own one of the computer in the world with the biggest uptime. I plan to kill it once it reaches ten years \o/

adastra22 4y ago
Hate to hear your Hubble, but there are systems with decades of uptime. Great accomplishment though!
- adastra22 4y ago
  Burst your bubble
  - mrtweetyhack 4y ago
dralley 4y ago
> But it's fun to think I own one of the computer in the world with the biggest uptime. The top 500 entries on that list are almost guaranteed to be mainframes.
- aarchi 4y ago
  According to Guinness, the top is Voyager 2: > The computer system that has been in continual operation for the longest period is the Computer Command System (CCS) onboard NASA's Voyager 2 spacecraft. This pair of interlinked computers have been in operation since the spacecraft's launch on 20 August 1977. As of 29 October 2020, the CCS has been running for 43 years 70 days. https://www.guinnessworldrecords.com/world-records/635980-longest-period-of-continual-operation-for-a-computer https://www.guinnessworldrecords.com/world-records/635980-lo...
  - ISL 4y ago
    Not a lot of bugs in space, so it is hard for them to get in....
  - ansible 4y ago
    43 years without a single reset or revision to safe mode (a common feature on spacecraft)? The linked article says that they've updated the software many times, by live patching it, instead of rebooting?
    - progre 4y ago
      Since there are 2 computers I'm guessing that they are letting one computer update and reset the other one, then repeat for the reverse. The system as a whole would stay up, the individual computers would not.
- TacticalCoder 4y ago
  > The top 500 entries on that list are almost guaranteed to be mainframes. That's very interesting. Your comment got me searching and I found a link here on HN: "Stratus: Servers that won’t quit – The 24 year running computer" with quite a discussion (123 comments) on the topic: https://news.ycombinator.com/item?id=13514909 https://news.ycombinator.com/item?id=13514909
romeoblade 4y ago
I reinstall once a year. Nowadays, with PXE booting, preseed files, and automation like Ansible, everything is pretty much automated for me. This goes for both my personal and work laptops. Both have been running some version of Debian for the last ten years. For the previous four/five years, I've been on Debian Sid, and I may run into an issue about every other year that requires me to use timeshift to go back to yesterday's OS backup. With the proper backup and automation strategies in place, I do not see a point in not doing a reinstall periodically. It definitely gives me peace of mind knowing I can be back online and 98% percent functional in under an hour in most cases on just about every device in the house.
- RcouF1uZ4gsC 4y ago
  > It definitely gives me peace of mind knowing I can be back online and 98% percent functional in under an hour in most cases on just about every device in the house. It is also a good test of disaster recovery. By wiping your devices and doing a fresh install, you catch hidden assumptions.
- pkulak 4y ago
  Sometimes I write a setup script or some other automation… but then the next re-install I do everything differently.
- inherently 4y ago
  that sounds awesome! could you provide a few more details? I'd love to set up something like that too
- deleted 4y ago
  [deleted]
- strboul 4y ago
  I have similar automation with Ansible. Can I see your config if it's open source?
WfAjWDYpDHDYCN5 4y ago
If you have a rootkit that you're concerned about copying around, that can somehow persist through pretty much everything on the system being upgraded at some point or another... you should probably also be worried about the various vectors that the rootkit could use to persist across OS reloads.
- sascha_sl 4y ago
  It doesn't really need to be well hidden if you're not actively looking. A shell script and a crontab entry / bashrc exec / init system entry is very low tech. Pair that with a slightly higher (but still low overall) tech LD_PRELOAD libc shim so it hides itself and you got something just stealthy enough that you wouldn't find it if you don't look for it. Remember, the easiest privilege escalation is aliasing sudo and patience.
- TacticalCoder 4y ago
  I don't disagree with that but some OS re-installs also correspond with buying an entirely new machine. And I'm the kind of paranoid person which burns instal DVDs and then checks the DVD's checksums from an offline computer before doing an install on my desktop, for example. Now, sure, the rootkit may try to hide in my Git repos (but that's not the easiest trick to pull) or shell scripts (but they're versioned with Git) etc. I still like it that way: a good old write-once DVD, checksum'ed, and a brand new install. Ideally on new hardware but that's not always the case.
burntsushi 4y ago
This is the best I've got, almost 2 years: $ w 15:25 up 725 days, 6:06, 1 user, load averages: 1.31 1.21 1.30 USER TTY FROM LOGIN@ IDLE WHAT andrew s000 192.168.1.200 15:25 - w But! This is a system in my office at home. Not in a data center somewhere.
- trashburger 4y ago
  Is that plugged to a UPS or is your power just that stable?
  - burntsushi 4y ago
    I get lots of outages. At least one a year that is 8+ hours. It's plugged into a UPS and I have a whole home standby generator.
- LAC-Tech 4y ago
  I'm more impressed you didn't get a single power cut in that time.
  - burntsushi 4y ago
    Oh I have. We get power outages all the time where I live. At least a few a year that last 8+ hours. Have even had some multi-day outages. I have all my machines plugged into UPSes and we have a standby whole home generator. So the only way any of my machines shut down is if I do it explicitly.
- TacticalCoder 4y ago
  Coming from the author of ripgrep, which is a tool I use daily, I've got to say it's an honor to see you answering my silly comment! Office at home certainly beats datacenter hosted but by 5x? Not sure... ; )
  - burntsushi 4y ago
    Hah. The only way it's possible where I live is with a UPS combined with a whole home standby generator. (I got the generator not just for uptimes haha. Got it because we get a lot of outages and we were losing a lot of spoiled goods from our fridge. About half our neighborhood has generators of some kind.)
sleepydog 4y ago
I reinstall every 2 years or so simply to re-evaluate what tools I have and decide if I really want them enough to install and configure them again. It's part of the reason I resist systems like Nix, Guix, or even dotfile management tools.
- hollerith 4y ago
  That doesn't make much sense because Nix doesn't prevent you from reinstalling, and after you reinstall, you are not forced to copy your old configuration.nix to your new /etc/nixos/.
  - kevincox 4y ago
    In fact I think Nix is much better here. Instead of reinstalling you can just audit your configuration for anything that you don't want. You don't need to worry about stray packages, config files or services like on other distributions. And of course if you accidentally clean too much it is easy to revert via source control of your config file.
- colordrops 4y ago
  Funny, I've had the opposite experience. Because Nix is so stable and allows risk-free easy experimentation and rollbacks, I'm always re-evaluating and upgrading my system. An added benefit is that the changes you make stick, and you've got a paper trail of the changes in git. You can create a whole set of changes behind a single flag or config file, and flip back and forth between different setups nearly instantaneously. With Ubuntu I was afraid to change anything because I might break things and not know how to get back to a working state. With Nix, you are always on a fresh, pristine system, because the file system is mostly read-only and an exact reflection of what's in your config. It's impossible to get crufty.
Symmetry 4y ago
I reinstall with every new version of Ubuntu for that, and to force myself to exercise my backups and install from scratch scripts.
mrtweetyhack 4y ago
Abishek_Muthian 4y ago
> or some 0-day owned my machine before it was patched, then I'd potentially have been copying / dd'ing / rsync'ing a rootkit for ten years. Isn't this a huge problem? Distro-preference/upgrade patterns aside, What's latest in the detection of a root-kit in the Linux desktop of an unsuspecting home user before they realize that they've been pwned(i.e. data exfiltration, ransomware etc.)? Assuming they aren't running any real-time scanners(Even if they want, Is there any real choice apart from ClamAV?)

adastra22 4y ago

Hate to hear your Hubble, but there are systems with decades of uptime. Great accomplishment though!

adastra22 4y ago
Burst your bubble
- mrtweetyhack 4y ago

dralley 4y ago

> But it's fun to think I own one of the computer in the world with the biggest uptime. The top 500 entries on that list are almost guaranteed to be mainframes.

aarchi 4y ago
According to Guinness, the top is Voyager 2: > The computer system that has been in continual operation for the longest period is the Computer Command System (CCS) onboard NASA's Voyager 2 spacecraft. This pair of interlinked computers have been in operation since the spacecraft's launch on 20 August 1977. As of 29 October 2020, the CCS has been running for 43 years 70 days. https://www.guinnessworldrecords.com/world-records/635980-longest-period-of-continual-operation-for-a-computer https://www.guinnessworldrecords.com/world-records/635980-lo...
- ISL 4y ago
  Not a lot of bugs in space, so it is hard for them to get in....
- ansible 4y ago
  43 years without a single reset or revision to safe mode (a common feature on spacecraft)? The linked article says that they've updated the software many times, by live patching it, instead of rebooting?
  - progre 4y ago
    Since there are 2 computers I'm guessing that they are letting one computer update and reset the other one, then repeat for the reverse. The system as a whole would stay up, the individual computers would not.
TacticalCoder 4y ago
> The top 500 entries on that list are almost guaranteed to be mainframes. That's very interesting. Your comment got me searching and I found a link here on HN: "Stratus: Servers that won’t quit – The 24 year running computer" with quite a discussion (123 comments) on the topic: https://news.ycombinator.com/item?id=13514909 https://news.ycombinator.com/item?id=13514909

romeoblade 4y ago

I reinstall once a year. Nowadays, with PXE booting, preseed files, and automation like Ansible, everything is pretty much automated for me. This goes for both my personal and work laptops. Both have been running some version of Debian for the last ten years. For the previous four/five years, I've been on Debian Sid, and I may run into an issue about every other year that requires me to use timeshift to go back to yesterday's OS backup. With the proper backup and automation strategies in place, I do not see a point in not doing a reinstall periodically. It definitely gives me peace of mind knowing I can be back online and 98% percent functional in under an hour in most cases on just about every device in the house.

RcouF1uZ4gsC 4y ago
> It definitely gives me peace of mind knowing I can be back online and 98% percent functional in under an hour in most cases on just about every device in the house. It is also a good test of disaster recovery. By wiping your devices and doing a fresh install, you catch hidden assumptions.
pkulak 4y ago
Sometimes I write a setup script or some other automation… but then the next re-install I do everything differently.
inherently 4y ago
that sounds awesome! could you provide a few more details? I'd love to set up something like that too
deleted 4y ago
[deleted]
strboul 4y ago
I have similar automation with Ansible. Can I see your config if it's open source?

WfAjWDYpDHDYCN5 4y ago

If you have a rootkit that you're concerned about copying around, that can somehow persist through pretty much everything on the system being upgraded at some point or another... you should probably also be worried about the various vectors that the rootkit could use to persist across OS reloads.

sascha_sl 4y ago
It doesn't really need to be well hidden if you're not actively looking. A shell script and a crontab entry / bashrc exec / init system entry is very low tech. Pair that with a slightly higher (but still low overall) tech LD_PRELOAD libc shim so it hides itself and you got something just stealthy enough that you wouldn't find it if you don't look for it. Remember, the easiest privilege escalation is aliasing sudo and patience.
TacticalCoder 4y ago
I don't disagree with that but some OS re-installs also correspond with buying an entirely new machine. And I'm the kind of paranoid person which burns instal DVDs and then checks the DVD's checksums from an offline computer before doing an install on my desktop, for example. Now, sure, the rootkit may try to hide in my Git repos (but that's not the easiest trick to pull) or shell scripts (but they're versioned with Git) etc. I still like it that way: a good old write-once DVD, checksum'ed, and a brand new install. Ideally on new hardware but that's not always the case.

burntsushi 4y ago

This is the best I've got, almost 2 years: $ w 15:25 up 725 days, 6:06, 1 user, load averages: 1.31 1.21 1.30 USER TTY FROM LOGIN@ IDLE WHAT andrew s000 192.168.1.200 15:25 - w But! This is a system in my office at home. Not in a data center somewhere.

trashburger 4y ago
Is that plugged to a UPS or is your power just that stable?
- burntsushi 4y ago
  I get lots of outages. At least one a year that is 8+ hours. It's plugged into a UPS and I have a whole home standby generator.
LAC-Tech 4y ago
I'm more impressed you didn't get a single power cut in that time.
- burntsushi 4y ago
  Oh I have. We get power outages all the time where I live. At least a few a year that last 8+ hours. Have even had some multi-day outages. I have all my machines plugged into UPSes and we have a standby whole home generator. So the only way any of my machines shut down is if I do it explicitly.
TacticalCoder 4y ago
Coming from the author of ripgrep, which is a tool I use daily, I've got to say it's an honor to see you answering my silly comment! Office at home certainly beats datacenter hosted but by 5x? Not sure... ; )
- burntsushi 4y ago
  Hah. The only way it's possible where I live is with a UPS combined with a whole home standby generator. (I got the generator not just for uptimes haha. Got it because we get a lot of outages and we were losing a lot of spoiled goods from our fridge. About half our neighborhood has generators of some kind.)

sleepydog 4y ago

I reinstall every 2 years or so simply to re-evaluate what tools I have and decide if I really want them enough to install and configure them again. It's part of the reason I resist systems like Nix, Guix, or even dotfile management tools.

hollerith 4y ago
That doesn't make much sense because Nix doesn't prevent you from reinstalling, and after you reinstall, you are not forced to copy your old configuration.nix to your new /etc/nixos/.
- kevincox 4y ago
  In fact I think Nix is much better here. Instead of reinstalling you can just audit your configuration for anything that you don't want. You don't need to worry about stray packages, config files or services like on other distributions. And of course if you accidentally clean too much it is easy to revert via source control of your config file.
colordrops 4y ago
Funny, I've had the opposite experience. Because Nix is so stable and allows risk-free easy experimentation and rollbacks, I'm always re-evaluating and upgrading my system. An added benefit is that the changes you make stick, and you've got a paper trail of the changes in git. You can create a whole set of changes behind a single flag or config file, and flip back and forth between different setups nearly instantaneously. With Ubuntu I was afraid to change anything because I might break things and not know how to get back to a working state. With Nix, you are always on a fresh, pristine system, because the file system is mostly read-only and an exact reflection of what's in your config. It's impossible to get crufty.

Symmetry 4y ago

I reinstall with every new version of Ubuntu for that, and to force myself to exercise my backups and install from scratch scripts.

mrtweetyhack 4y ago

Abishek_Muthian 4y ago

> or some 0-day owned my machine before it was patched, then I'd potentially have been copying / dd'ing / rsync'ing a rootkit for ten years. Isn't this a huge problem? Distro-preference/upgrade patterns aside, What's latest in the detection of a root-kit in the Linux desktop of an unsuspecting home user before they realize that they've been pwned(i.e. data exfiltration, ransomware etc.)? Assuming they aren't running any real-time scanners(Even if they want, Is there any real choice apart from ClamAV?)