Hacker News Reader

Comment by noasaservice | Hacker News Reader

Unlike Windows, you CAN shutdown a service in Linux, update it, and restart it.

Uptime gets the *system* uptime, not a service uptime. And only Kernel and glibc require reboots... And with hotpatches, a reboot isn't strictly required either.

View on HN

You can do the same on Windows, though this isn't done for client editions as they're mostly for interactive use - and on Linux you might run into issues the more complex dbus-y GUI bits you use too. There's even kernel hot patching, although it's exclusive to some cloud server editions as they're a known environment compared to desktop systems.

Yeah, it's an interesting relative of the CAP Theorem space, from what I can see of it: In theory Windows has most of the raw engineering tools to do hot-patching similar to Linux. In practice Windows seems to prefer for interactive users a Consistency/Fewer "Partitions" over Availability and shifts that position for server SKUs. Arguably an interactive user is much more likely to have problems with an Inconsistent OS state and see more "weirdness" from partitioning/splits in the OS state than a server app in a (relative) steady state with well known to the OS dependencies.

I was thinking about the kernel, 65 CVEs so far this year.

At least they are honest about them unlike windows where we won't find NT kernel vulnerabilities for a decade sometimes and by then it's been widely exploited.

You missed the point. The point was that 65 CVEs mean that you should at least have rebooted your PC 65 times. No judgment on whether that's few or many CVEs.

> you should at least have rebooted your PC 65 times

Really not every CVE in the kernel applies to every system and configuration. You can compile the linux kernel in all kinds of different ways and a decent number of security vulnerabilities found in any given year only apply to unusual configurations.

Not every CVE affects every system. The kernel is modular and most people don't run every module.

Unless every single one of those CVEs was actively exploited at the time a fix was committed to the kernel, no. Just no.

Even then, no.

Looking at those 65 CVEs[1] and thinking just about the desktop use case (as that's what this is about), none of them really stand out as "zomg update immediately!" A number just aren't applicable at all for most desktop users, and quite a lot of others aren't readily exploitable, and are not cause for a panic update and reboot.

[1]: https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

In addition to what others have said, CVSs often come in related groups, and are patched together. It's likely that a single kernel security release will fix multiple related CVEs all at once.

There are KernelCare, Livepatch which enable updates without the need to reboot.

Ehhh not really. Linux is just generally bad about saying you should reboot when you really should reboot. For example if any of the commonly used libraries (like gtk) are updated, you really really should reboot or you'll get random bugs and glitches.

If you're running a server and you can be sure to do a full restart of that service including any other dependencies then sure. But isn't that functionally a reboot anyway? It's not like keeping just the kernel alive meaningfully changes anything. Your services were still interrupted.

Reply on news.ycombinator.com