I remember when you were actually able to keep up with CVEs and you could (at least somewhat) prioritize patches while disregarding those which felt irrelevant.
But now.. are we simply supposed to use our f̶a̶v̶o̶r̶i̶t̶e̶ package manager and batch update our systems in a loop?
while true; do apt-get update && apt-get upgrade -y; sleep 1d; done
wait. erhm... and probably an automatic reboot/kernel reload every 48h; THAT WILL DO IT! </sarcasm>
Especially in environments where manglement mandate something like Qualys, leading to demands that systems must be patched to address the critical vulnerabilities that it's reported despite said vulnerabilities being unexploitable.
One that I trot out periodically as an example of this is a CVE that would only be exploitable if running on an IBM s390 with EBCDIC codepages. Our security team nevertheless wanted it patched, because Qualys said it was a vulnerability.
This is a confusing comment because Debian/Ubuntu/etc (you referenced apt) have separate security repositories that exist for this purpose. They have only security fixes and don't try to unnecessarily fix "other" stuff. I have not heard of the security repos pushing out a breaking update before.
`unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.
Theoretically they should slow down. I suspect people will be much pickier about which apps to use in production. Which, ironically, will be directly at odds with more and more products being pumped out..
>Alternatively, you might shrug and wait to see which
of these will get a logo and catchy name in the next
few weeks and then try to focus on those.
hehehe
>Another approach might be to sit back, have a nice cup
of zen, and just always pull all updates and then
update your entire fleet of systems on a weekly basis,
which, yes, I sure would like to be able to do, but
reality keeps getting in my way.
Am I the only one that gets concerned about the laissez-faire approach to security that a LOT of people take. I get that some exploits are not like the others, but some of the shit I've seen in places....
12 comments
[ 2.5 ms ] story [ 33.0 ms ] threadBut now.. are we simply supposed to use our f̶a̶v̶o̶r̶i̶t̶e̶ package manager and batch update our systems in a loop?
wait. erhm... and probably an automatic reboot/kernel reload every 48h; THAT WILL DO IT! </sarcasm>One that I trot out periodically as an example of this is a CVE that would only be exploitable if running on an IBM s390 with EBCDIC codepages. Our security team nevertheless wanted it patched, because Qualys said it was a vulnerability.
`unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.
We need to start looking at seL4 as the base, instead.
hehehe
>Another approach might be to sit back, have a nice cup of zen, and just always pull all updates and then update your entire fleet of systems on a weekly basis, which, yes, I sure would like to be able to do, but reality keeps getting in my way.
Am I the only one that gets concerned about the laissez-faire approach to security that a LOT of people take. I get that some exploits are not like the others, but some of the shit I've seen in places....