Re: [nottingham] Security Patches

From: Jon Masters (jonathan@jonmasters.org)
Date: Thu 01 Nov 2001 - 18:35:12 GMT


On Thu, 1 Nov 2001, Nick Reynolds wrote:

> I would be interrested to hear your experiences of patching different
> distributions

Hi,

At home I tend to run Debian (unstable mostly) as distribution of choice,
though we also run deadrat and have used stuff ranging from slackware and
rock to SuSE and Mandrake. I have the Debian security lines in my apt
sources and run an update once per day on apogee.jonmasters.org (which is
running unstable due to me wanting recent kernel/usb/hotplug stuff for
the usb adsl kit) but I only upgrade what needs upgrading when here. In
Nottingham I run Debian on perihelion and deadrat on perigee but the
"new" apohelion will run Debian when I finish installing it this weekend.

At work the rule is for workstations/servers Debian is used, with
potato (stable) being used on the gateway and externally accessable boxes
- with the security sources in. Some do apt-get upgrades automatically on
stable boxen however I prefer to at least see what it's going to do...

> and any problems you have got into using utilities that go away
> and try and update everything for you.

In recent history, I'm invovled with the admin team that look after a
server provided for projects at a certain academic institution. It was
running Debian stable until some patches needed to be made. Unfortunately,
one of the other guys had changed the apt sources to point at unstable
without changing it back again...another person logged in and did an
"upgrade". Normally though, I suppose you would notice when it started
saying it was updating everything under the sun :)

> How do you find 'apt-get', 'Update Agent' or whatever your distribution uses
> in terms of reliability.

...a little bit better than Windows Update :) I wonder when they'll try to
play that "remote update" patent they have for all it's not worth.

I have never had any problems with apt itself. Sometimes a few broken
packages in unstable which it informs me are broken and says it will not
upgrade but that's my fault for using unstable. I like it how I can log in
to a machine that doesn't have something I want and just say "apt-get
install blah" and a couple of seconds later...there it is, including
anything else it depends upon, etc. etc. no messing about.

> How well does it handle existing configuration files when upgrading
> packages.

Part of the Debian philosophy seems to be that you don't mess with a
user's configuration files unless they say so. Most packages will say
something to the effect that they'd like to make changes to configuration
files or provide some new ones but often I simply say "no" (default) and
look for changes I need to make later. For most things where changes are
required as part of a major version change or something, packages are
often good at doing the changes for you - 'corse that depends who's
written the package your using. I looked at Rock recently and quite liked
it from the "die hard" fan viewpoint, but I wouldn't like to keep bunches
of rock boxes up to date on a daily basis I think. I could be wrong.

> Has your machine ever been left in an unstable state?

Yes on my desktops, but only because I'm running unstable (:P) and am
asking for it. Actually, it's rare that enough happens to totally break
everything - more often it'll be something subtle like a problem with
binutils which was prevening me from compiling new kernels for a couple of
days a while ago. I can't recall hearing any problems with updates to
stable machines really.

> I haven't used Debian for a few years although it was always my distribution
> of choice for a number of years on my home machine (before apt-get), however
> reliability is far more important at work and using a tool such as 'apt-get'
> to automate upgrading systems seems a bit risky to me.

I don't really see it as risky if you're running stable and just getting
security patches. I admit that I prefer running the process where I can
see what it's doing rather than solely rely on an automated update. One
thing I never have done is rely on or use a distributon's kernels other
than the one that comes with the initial install - first thing that needs
fixing and I'll stick my own in, seems less hassle in the longer run.

Anyway, try Debian again, you'll like it :) I used Slackware for quite a
long time before I got in to Readhat/SuSE. Then I used Debian as a user
for a while before a number of friends managed to convince me to switch
over. Now I'm completely hooked until something better comes along.

> Also, how good do you find your distribution is when it comes to security
> patches being released quickly?

Hours, not days :) Mostly Debian has fixes on/very soon after initial
bugtraq postings. Apart from the bind/kernel vulverabilities, recently I
seem to have had few problems. I am reviewing the Owl kernel patches at
the moment for next LU issue and considering sticking those in on machines
I use (especially when the 2.4 stuff comes out).

Oh btw, hi everyone, I've been dead for a while but I seem to be alive
again now. Apparently there's a lot I need to catch up on and something
about drinkies/installfest sometime soon...I'll go read archives.

Let's all meet up again soon...I volunteer to give a talk.

--jcm

--------------------------------------------------------------------
http://www.lug.org.uk http://www.linuxportal.co.uk
http://www.linuxjob.co.uk http://www.linuxshop.co.uk
--------------------------------------------------------------------



This archive was generated by hypermail 2.1.3 : Thu 22 Nov 2001 - 13:18:47 GMT