Hacker News Reader

Comment by Gigachad | Hacker News Reader

Problem is it takes more effort to read the CVE list and work out if you have one of the drivers impacted loaded than it does to just update the kernel.

View on HN

Sorry but I'm not causing outages and rebooting systems every four days because the people whose job it is to do this can't triage properly. They are actively making other's lives more difficult. There's like 100 CVEs in that list and not a one of them is important to most systems. Even worse, if there was 1/100 it's a needle in a haystack.

If your system goes down to update a kernel then you have a major issue already. This is like manually renewing https certs. When the task is done often enough you just automate it in a painless way.

There is more to the real world than running webshit behind VM clusters.

Real businesses still run legacy file/print services, license daemons, proprietary applications. Some still run on bare metal.

You need outage windows. You can't just YOLO it and update prod during the day, it's unbelieveably irresponsible.

Well then, it's a business decision to accept the risks. IMO it makes sense that a percentage of machines would always be offline for maintenance. If you're running bare metal and you cannot afford 10% of your machines being offline at most times, then you're in deep shit if there's even a tiny traffic irregularity, and it's a sign that your management is YOLOing the company. Not uncommon though.

Reply on news.ycombinator.com