3 ms·

I don't see how it's possible to actually support that considering how many components make up an OS. What would happen if libc had a vulnerability that needed

I don't see how it's possible to actually support that considering how many components make up an OS. What would happen if libc had a vulnerability that needed patching? I know a reboot wouldn't be forced but wouldn't it only take effect when all the processes using it restart?

mapontosevenths 1y ago
Windows has been around for 40 years, and is worth more than the GDP of many nations. In fact, some of the Windows server versions actually include the feature. It's not that it's an impossible problem, it's that Microsoft doesn't have to compete...so they don't.
- Rohansi 1y ago
  > some of the Windows server versions actually include the feature If you looked into it though you'd see that you do still need to restart at least every quarter for baseline updates. If you don't restart then future hotpatch updates will not apply because they only target the current baseline update. There are also unplanned baseline updates that require a restart to patch zero-day exploits that cannot be fixed in a hotpatch. I'm still not understanding how this is a solved problem on Linux. If there is a vulnerability in libc then you need to restart (probably) all processes to have the fix take effect.
  - mapontosevenths 1y ago
    > m still not understanding how this is a solved problem on Linux. If there is a vulnerability in libc then you need to restart (probably) all processes to have the fix take effect. Restarting the service that was directly impacted by the patch is preferable to the 1980's techno-brained idea of rebooting the entire system. Most of the time it isn't glibc. FWIW - I did recently read that hotpatching is already there in 11 if you enable it in an enterprise. Fingers crossed it comes to home users.
    - Rohansi 1y ago
      The reason I brought up libc is there are a lot more userspace shared libraries in Windows that could need patching.

mapontosevenths 1y ago

Windows has been around for 40 years, and is worth more than the GDP of many nations. In fact, some of the Windows server versions actually include the feature. It's not that it's an impossible problem, it's that Microsoft doesn't have to compete...so they don't.

Rohansi 1y ago
> some of the Windows server versions actually include the feature If you looked into it though you'd see that you do still need to restart at least every quarter for baseline updates. If you don't restart then future hotpatch updates will not apply because they only target the current baseline update. There are also unplanned baseline updates that require a restart to patch zero-day exploits that cannot be fixed in a hotpatch. I'm still not understanding how this is a solved problem on Linux. If there is a vulnerability in libc then you need to restart (probably) all processes to have the fix take effect.
- mapontosevenths 1y ago
  > m still not understanding how this is a solved problem on Linux. If there is a vulnerability in libc then you need to restart (probably) all processes to have the fix take effect. Restarting the service that was directly impacted by the patch is preferable to the 1980's techno-brained idea of rebooting the entire system. Most of the time it isn't glibc. FWIW - I did recently read that hotpatching is already there in 11 if you enable it in an enterprise. Fingers crossed it comes to home users.
  - Rohansi 1y ago
    The reason I brought up libc is there are a lot more userspace shared libraries in Windows that could need patching.