Hacker News Reader

Comment by avodonosov | Hacker News Reader

What command should I run manually?

Just setup daily unattended security updates.

For 99% of fixes, though I'm unsure about the specifics of this one, just having unattended upgrades enabled will do little/nothing to protect you.

Installing the upgraded package often won't restart the service, meaning you're still running old code, and in the case of libraries, won't restart every process on the system that has loaded the library, meaning you're still running old code...

Hey, Ubuntu/Debian contributor here. Actually, 99% is misrepresenting it. Any [well-packaged] service upgraded through unattended-upgrades (nginx included) gets restarted through package hooks. What unattended-upgrades won't help with are:

  1. Updates to the kernel
  2. Updates to system libraries which services depend on

For 1, if you run Ubuntu you now have canonical-livepatch: http://blog.dustinkirkland.com/2016/10/canonical-livepatch.h...

2 remains a problem, and yes, if you're thinking openssl, that's a problem. But you can track what goes into /var/run/reboot-required.pkgs to see it's really not 99% of fixes we're streaming to you.

See http://askubuntu.com/questions/775504/does-unattended-upgrad... for a more complete discussion.

sudo apt upgrade

You forgot to update first

Indeed (s)he did:

  sudo apt update
  sudo apt upgrade