5 ms·

I was pretty floored the first time I was diagnosing a server problem and it turned out an Ubuntu update had pulled the Sun Java out from underneath the Tomcat

by lnanek 15y ago

I was pretty floored the first time I was diagnosing a server problem and it turned out an Ubuntu update had pulled the Sun Java out from underneath the Tomcat server that was running and replaced it with OpenJDK, which didn't work for the big webapps that were running. That was last year, though - maybe that was it moving to partner and now it is moving again? I wish they would restrict this funny business to distro upgrades, which people expect to break things.

gravitronic 15y ago
Do you usually let ubuntu upgrade packages automatically on live systems? I am not a server admin but that seems like a plan for constant random breakage...
- tomjen3 15y ago
  They usually only provide security upgrades.
  - starwed 15y ago
    I guess this technically was a security update -- that version of Java had known vulnerabilities that they could not distribute fixes for. (Because of Oracle's license changes.)
- jiggy2011 15y ago
  I do, how else can I be safe(ish) from having my server attacked by some random 0day just because I didn't happen to check the advisories for every single daemon I use every week?
  - 0x0 15y ago
    Or you can get "push notifications" of security updates via SMTP, https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-an... :)
drzaiusapelord 15y ago
Ubuntu has two levels of updates. Security updates and just updates. The former is just that, security fixes. I'm not even sure what the hell the latter is supposed to be. "Random upgrades to versions of random things we think you should be running?" That's like taking a Windows server and randomly pulling installers from Microsoft's site and installing them willy-nilly. Of course bad things will happen. I never use the latter, ever.
- sciurus 15y ago
  Ubuntu has a well defined update policy and process. It couldn't be farther from "randomly pulling installers... and installing them willy-nilly". It's documented at https://wiki.ubuntu.com/StableReleaseUpdates https://wiki.ubuntu.com/StableReleaseUpdates Here is an excerpt describing what's eligible for an upgrade- "Stable release updates will, in general, only be issued in order to fix high-impact bugs. Examples of such bugs include: Bugs which may, under realistic circumstances, directly cause a security vulnerability. These are done by the security team and are documented at SecurityTeam/UpdateProcedures. Bugs which represent severe regressions from the previous release of Ubuntu. This includes packages which are totally unusable, like being uninstallable or crashing on startup. Bugs which may, under realistic circumstances, directly cause a loss of user data Bugs which do not fit under above categories, but (1) have an obviously safe patch and (2) affect an application rather than critical infrastructure packages (like X.org or the kernel)." If you don't trust the packages Ubuntu provides as updates, why do you trust the packages they initially provided with the release? I think that in most cases the updates are going through a more rigorous QA process than the initial packages.

by lnanek 15y ago

gravitronic 15y ago

Do you usually let ubuntu upgrade packages automatically on live systems? I am not a server admin but that seems like a plan for constant random breakage...

tomjen3 15y ago
They usually only provide security upgrades.
- starwed 15y ago
  I guess this technically was a security update -- that version of Java had known vulnerabilities that they could not distribute fixes for. (Because of Oracle's license changes.)
jiggy2011 15y ago
I do, how else can I be safe(ish) from having my server attacked by some random 0day just because I didn't happen to check the advisories for every single daemon I use every week?
- 0x0 15y ago
  Or you can get "push notifications" of security updates via SMTP, https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-an... :)

drzaiusapelord 15y ago

Ubuntu has two levels of updates. Security updates and just updates. The former is just that, security fixes. I'm not even sure what the hell the latter is supposed to be. "Random upgrades to versions of random things we think you should be running?" That's like taking a Windows server and randomly pulling installers from Microsoft's site and installing them willy-nilly. Of course bad things will happen. I never use the latter, ever.

sciurus 15y ago
Ubuntu has a well defined update policy and process. It couldn't be farther from "randomly pulling installers... and installing them willy-nilly". It's documented at https://wiki.ubuntu.com/StableReleaseUpdates https://wiki.ubuntu.com/StableReleaseUpdates Here is an excerpt describing what's eligible for an upgrade- "Stable release updates will, in general, only be issued in order to fix high-impact bugs. Examples of such bugs include: Bugs which may, under realistic circumstances, directly cause a security vulnerability. These are done by the security team and are documented at SecurityTeam/UpdateProcedures. Bugs which represent severe regressions from the previous release of Ubuntu. This includes packages which are totally unusable, like being uninstallable or crashing on startup. Bugs which may, under realistic circumstances, directly cause a loss of user data Bugs which do not fit under above categories, but (1) have an obviously safe patch and (2) affect an application rather than critical infrastructure packages (like X.org or the kernel)." If you don't trust the packages Ubuntu provides as updates, why do you trust the packages they initially provided with the release? I think that in most cases the updates are going through a more rigorous QA process than the initial packages.