Hacker News Reader

Comment by dboreham | Hacker News Reader

Using the distro-supplied packages for PG (or any database server) is typically not the best choice for a production deployment.

View on HN

    > Using the distro-supplied packages for PG
    > (or any database server)

Or almost any of your application environment, really.

Distro supplied packages are a handy way of receiving timely security fixes without keeping too close an eye on recent CVEs + application changelogs.

For regular packages, sure. But for highly-active, well-maintained codebases like postgres – who package their software for your OS, upstream is going to be quicker with security fixes than distro.

I would like to hear more about that. Our Server Team swears on using CentOS Packages with Backports for everything for security purposes. This slows us a bit down, but so far we haven't had any security or audit related issues. How do you deal with CVEs and these staying audited and secure?

We use CentOS but PostgreSQL's official packages from their repo, just like we did when we were Debian based. http://yum.postgresql.org/

We use the official PG packages from their repo on CentOS. It appears there is an apt repository for Ubuntu too: https://www.postgresql.org/download/linux/ubuntu/

Reply on news.ycombinator.com