3 ms·

I think it would have to be handled by the platform provider. Someone like Heroku could make it happen. Or you could set up a cron-like worker to perform a pip

by kmfrk 14y ago

I think it would have to be handled by the platform provider. Someone like Heroku could make it happen. Or you could set up a cron-like worker to perform a pip-review (https://github.com/nvie/pip-tools https://github.com/nvie/pip-tools) of sorts. I don't know if I like the idea of a single point of failure; whatever service pushes the update would have a big, fat Wile E. Coyote target on its back. I am currently trying to figure out something similar for a Django-based app at the moment. I include a version in the settings file that I plan on comparing against some sort of version array on a central website. If a new security update is available, a conditional notification will show up for admins, but they will still have to update somewhat manually - I can't set up a cron job to trigger the whole procedure, especially because it might wreck their service, depending on how it works.

eggbrain 14y ago
'I don't know if I like the idea of a single point of failure; whatever service pushes the update would have a big, fat Wile E. Coyote target on its back.' This is a solved problem though, right? Antivirus companies deal with this when they push out definition updates that render backdoors ineffective, and yet while they probably are targeted by the virus makers, they have been quite resilient.
- jiggy2011 14y ago
  Not sure about the AV servers themselves but a common thing for malware to do is to MITM or rebind DNS entries so that AV software updates are served from the attackers server.
michaelmior 14y ago
Something like Gemnasium? https://gemnasium.com/ https://gemnasium.com/
- kmfrk 14y ago
  That still doesn't automate the process, and there is no telling whether 1.0.1 is a small update or a security update. Having said that, I really want a service like this, and I wanted to make one for Python (PIP) at one point, but hopefully someone more competent will do it or has already. A different version notation is needed to know whether the version delta between your installation and the most recent contains vital security updates.

by kmfrk 14y ago

eggbrain 14y ago

'I don't know if I like the idea of a single point of failure; whatever service pushes the update would have a big, fat Wile E. Coyote target on its back.' This is a solved problem though, right? Antivirus companies deal with this when they push out definition updates that render backdoors ineffective, and yet while they probably are targeted by the virus makers, they have been quite resilient.

jiggy2011 14y ago
Not sure about the AV servers themselves but a common thing for malware to do is to MITM or rebind DNS entries so that AV software updates are served from the attackers server.

michaelmior 14y ago

Something like Gemnasium? https://gemnasium.com/ https://gemnasium.com/

kmfrk 14y ago
That still doesn't automate the process, and there is no telling whether 1.0.1 is a small update or a security update. Having said that, I really want a service like this, and I wanted to make one for Python (PIP) at one point, but hopefully someone more competent will do it or has already. A different version notation is needed to know whether the version delta between your installation and the most recent contains vital security updates.