Hacker News Reader

Comment by SV_BubbleTime | Hacker News Reader

Article said GitLab patched back in April. Safe to say you didn’t deploy these patches?

No judgment. I’m paid to make things, not apply patches. This is however why I don’t use self-hosted, pros and cons, etc.

View on HN

Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.

Depending on how you have it installed you could have your package management system automatically install the updates. They aren't always perfect though, I've had at least one Gitlab update that required manually running migrations commands since the ones in the update script failed for some reason. I wouldn't trust doing it automatically.

And I'm not sure about gitlab, but their are often mailing lists for security updates for major software packages.

I highly recommend debian's auto update feature (works on derivatives):

https://www.linode.com/docs/guides/how-to-configure-automate...

I've never had any problems with it, although I just run a couple of servers :).

If everyone enabled this one thing I'm sure the Internet would be significantly safer.

Obs: You can select security updates only which I believe are unlikely to break anything!

Thanks for the productive response. I was using Watchtower in Docker Compose on all instances, but I had it misconfigured. My fault for assuming auto updates were working without verifying, lesson learned.

GitLab team member here.

The way to keep up-to-date on critical security updates for GitLab is to sign up for our Security Alerts mailing list: https://about.gitlab.com/company/preference-center/

Yes, you are meant to be paying attention to the security news for all tools you self host. That's part of self hosting. If you can't manage that (which is completely fair), then you shouldn't be self hosting.

What's the best way to keep up on security news for a set of tools?

I once had a CVE RSS feed, but it was mostly noise even after I filtered it to only tools/libraries we used.

Reply on news.ycombinator.com