2 ms·

So what you're proposing it tracking security updates manually and update your libraries? As much as it's hackish, it's possible to update virtualenv's libs. B

by zobzu 14y ago

So what you're proposing it tracking security updates manually and update your libraries? As much as it's hackish, it's possible to update virtualenv's libs. But tracking the security update is another story. If not tracking hundred of libs manually is bad sysadmining, well, I'd like you to be my sysadmin and track them. There's even a bigger issue here: many of those libs have zero tracking. That means even if their author fixes a security bug in the source, he probably won't mark it. And you, not being a sloppy sysadmin, how will you deal with that? It's pretty obvious to me that you just don't deal with it. Then one day one of those libs will be widely used, have a bad bug and everyone will scour their systems to update.. but of course the damage will already have been done.

kisielk 14y ago
It's pretty common to deploy Python apps via a virtualenv. In most cases you will use something like a pip requirements.txt or fabfile for Fabric to define how to deploy your app and what are the dependencies. The file is tracked in version control along with the rest of your project. If at some point you need to upgrade one of the libraries due to a security vulnerability, you would change the dependency in the requirements file and roll out a new version of your app to all your servers. If you have multiple apps, then repeat the process for each app. Generally it would be a bad idea to rely on a single installed version because often times the API can change between versions and different apps may target different versions of a library. It's preferable that each one has its own dependencies isolated in a virtualenv unless you have a really rigorous process for keeping all your apps updated to the latest library versions.
- zobzu 14y ago
  Well that still doesn't tell you when you have a security upgrade. Of course you can update libs in the virtualenv, i know that much :)

by zobzu 14y ago

kisielk 14y ago

It's pretty common to deploy Python apps via a virtualenv. In most cases you will use something like a pip requirements.txt or fabfile for Fabric to define how to deploy your app and what are the dependencies. The file is tracked in version control along with the rest of your project. If at some point you need to upgrade one of the libraries due to a security vulnerability, you would change the dependency in the requirements file and roll out a new version of your app to all your servers. If you have multiple apps, then repeat the process for each app. Generally it would be a bad idea to rely on a single installed version because often times the API can change between versions and different apps may target different versions of a library. It's preferable that each one has its own dependencies isolated in a virtualenv unless you have a really rigorous process for keeping all your apps updated to the latest library versions.

zobzu 14y ago
Well that still doesn't tell you when you have a security upgrade. Of course you can update libs in the virtualenv, i know that much :)