Hacker News Reader

Comment by eggsome | Hacker News Reader

For anyone who want's something tiny, complete and secure check out djbdns. I use it for a 700 user org as a secondary DNS. Never goes above single digit CPU usage (on an AWS nano instance) and currently has 834 days of uptime.

One of my favorite pieces of software.

View on HN

Its impressive that it's reliable.

It's worrying that your uptime indicates you don't patch frequently.

As a general rule you make a good point, but in the case of djbdns there has been no need to patch for years.

See here: https://cr.yp.to/djbdns/guarantee.html

Kernel updates?

FWIW, there are mechanisms to live-patch the kernel, there were some out of tree approaches (ksplice, kGraft, kpatch) but nowadays, the kernel has native support that those (kGraft and kpatch IIRC) now can use:

https://www.kernel.org/doc/html/latest/livepatch/livepatch.h...

https://wiki.archlinux.org/title/Kernel_live_patching

Most enterprise distros provide a service for that, as the actual work is to create the binary patch fixing the security issues at hand, as one can not always just use the upstream version, e.g., if that introduces internal ABI changes or changes locking (order) - as then you'd need to patch X sites atomically at once to ensure nothing falls apart, can be done but hard to get right.

So yes, if you're willing to put in the money or work you can have systems that run for years and still are just as secure as those that frequently reboot into new updated kernels.

Reply on news.ycombinator.com