3 ms·

That's cool. However, people must still understand the software they are using. For instance, someone is selling Nginx 0.8. The latest version is 1.0.15.

sshconnection 15y ago
Agreed. I saw "turnkey rails" in the sidebar and thought I'd take a look into it. It's very unclear what versions of software are included. The last changelog entry on 2011/12/06 says nothing about ruby or rails versions. The last mention was 2011/01/27 claiming REE 1.8.7-2010.02_i386_ubuntu10.04. To give a perspective on update frequency, according to the same page (http://www.turnkeylinux.org/updates/rails http://www.turnkeylinux.org/updates/rails), two updates before that was Fri, 2009/10/23 - 16:35. This update claims to have ruby 4.1 installed. It seems that their VM image also includes a time machine. Not getting a huge feel of confidence from that being featured on their landing page. An open market can be good, but when it comes to supplying an image for my production env, that type of thing could leave me feeling a bit uneasy.
- alexchamberlain 15y ago
  It's a shame, because this is how we get massive security scares that affect the whole industry. One person couldn't be bothered to upgrade Apache and the whole industry is insecure.
tybris 15y ago
Nginx 0.8 with support. Sure, 1.0.15 would be better, but enterprises generally care more about support than about having the latest version (see Red Hat).
- alexchamberlain 15y ago
  Yes, but there are several major security advisories since 0.8. Any support worth their pay would be using the latest version.
  - rwmj 15y ago
    Version numbers aren't that relevant for Red Hat's packages, because we backport security fixes (and features) into the older versions. And yes, customers prefer it that way.
    - alexchamberlain 15y ago
      Ok, I don't really have a problem with how Red Hat do things. However, if I was employing a sysadmin to administrate my servers, I want the latest production software please.
      - rwmj 15y ago
        I have to ask .. why? If you're worried about security updates, Red Hat monitors dozens of channels and backports all security fixes to all supported software, so that's not a problem. If you're worried about features, Red Hat selectively backports features at customer request, or gives the customers free updates to the new RHEL. Our customers want to install a particular release of RHEL and have it work and supported for 10 years. They actively don't want random version upgrades (which often remove as many things as they add, as well as causing exciting new bugs).
    - freehunter 15y ago
      Through the vulnerability scanning I do at work, our tool marks a lot of things just based on version numbers. Looking into them deeper, I see the backported patch has been applied. RHEL does a pretty good job on this, really stands out. Makes my vulnerability scanning a little more time consuming, but frees up time I would otherwise be spending on documenting security breeches and data loss. Kudos.

sshconnection 15y ago

Agreed. I saw "turnkey rails" in the sidebar and thought I'd take a look into it. It's very unclear what versions of software are included. The last changelog entry on 2011/12/06 says nothing about ruby or rails versions. The last mention was 2011/01/27 claiming REE 1.8.7-2010.02_i386_ubuntu10.04. To give a perspective on update frequency, according to the same page (http://www.turnkeylinux.org/updates/rails http://www.turnkeylinux.org/updates/rails), two updates before that was Fri, 2009/10/23 - 16:35. This update claims to have ruby 4.1 installed. It seems that their VM image also includes a time machine. Not getting a huge feel of confidence from that being featured on their landing page. An open market can be good, but when it comes to supplying an image for my production env, that type of thing could leave me feeling a bit uneasy.

alexchamberlain 15y ago
It's a shame, because this is how we get massive security scares that affect the whole industry. One person couldn't be bothered to upgrade Apache and the whole industry is insecure.

tybris 15y ago

Nginx 0.8 with support. Sure, 1.0.15 would be better, but enterprises generally care more about support than about having the latest version (see Red Hat).

alexchamberlain 15y ago
Yes, but there are several major security advisories since 0.8. Any support worth their pay would be using the latest version.
- rwmj 15y ago
  Version numbers aren't that relevant for Red Hat's packages, because we backport security fixes (and features) into the older versions. And yes, customers prefer it that way.
  - alexchamberlain 15y ago
    Ok, I don't really have a problem with how Red Hat do things. However, if I was employing a sysadmin to administrate my servers, I want the latest production software please.
    - rwmj 15y ago
      I have to ask .. why? If you're worried about security updates, Red Hat monitors dozens of channels and backports all security fixes to all supported software, so that's not a problem. If you're worried about features, Red Hat selectively backports features at customer request, or gives the customers free updates to the new RHEL. Our customers want to install a particular release of RHEL and have it work and supported for 10 years. They actively don't want random version upgrades (which often remove as many things as they add, as well as causing exciting new bugs).
  - freehunter 15y ago
    Through the vulnerability scanning I do at work, our tool marks a lot of things just based on version numbers. Looking into them deeper, I see the backported patch has been applied. RHEL does a pretty good job on this, really stands out. Makes my vulnerability scanning a little more time consuming, but frees up time I would otherwise be spending on documenting security breeches and data loss. Kudos.