Hacker News Reader

Comment by 0xC0ncord | Hacker News Reader

Most bugs that get backported to stable kernels only get backported if they are serious enough or have a CVE assigned to them. Many bugs with potential security implications go unfixed because of this.

View on HN

Oh, OK. I learned something important today. Thanks a lot.

Yea, it's not just desktop either but having stable releases for server workloads is pretty much essential. If there's no need to update for any required feature in a later version then doing updates for the sake of it just creates churn and actually increases the risk of potential outages. Stable with backported fixes for security means that only updates for security need to be actioned.

I strictly run Debian Stable on my own servers but, they're low in numbers (office uses CentOS, because we need to), and I use unattended upgrades on these small servers. At the end of the day, I don't touch them unless I have to (because updates restart services most of the time anyway), but I understand your point completely.

I'm not against only back porting serious security fixes only (since both time and resources are limited, and a good trade-off is always the best choice). Just it did occurred to me that I didn't wrap my head around the details of this particular subject.

Yea, I used unattened-upgrades for everything not libc/kernel and then use the requires-restart stuff (you can do this on centos and debian based distros) just to make sure it's a bit more managed. Nowadays a lot more stuff I deploy is in immutable containers with health checks so tends to be less of a pain, but you trade that off in increase in complexity and overheads etc. Still have to reboot hypervisors too if not managed.

Reply on news.ycombinator.com