Comment on LiveOverflow - php situation 24h later (YouTube)
stuner@lemmy.world 6 days agoYes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.
Comment on LiveOverflow - php situation 24h later (YouTube)
stuner@lemmy.world 6 days agoYes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.
Thaurin@lemmy.world 5 days ago
Don’t people use unattended upgrades? Crowdsec’s WAF Appsec or Cloudfare’s WAF also put up patches that would’ve caught these vulnerabilities before the official PHP patches were released.
Of course, those normally run once per 24 hours, which is a little late…
Luckyfriend222@lemmy.world 5 days ago
No. Unattended upgrades are a nightmare in production. If you patch stuff manually or even with ansible, you can see what the hell broke during the upgrade. Whereas with unattended access you walk in Monday morning with half your systems down and no idea which update broke it.
needanke@feddit.org 5 days ago
For professionals, buisnesses sure. But for selfhosting? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities.
Thaurin@lemmy.world 5 days ago
Yeah, for businesses I can see that, but selfhosting, meh. I have just one personal server firewalled and Wireguarded, so the PHP vulnerability wasn’t even publicly exposed. Even so, I have never had any issues with Debian’s unattended security upgrades in the last 5 years.
In enterprise environments with a hundred servers, though, you will want to do something else than I do. :)
frongt@lemmy.zip 5 days ago
Unattended application to test. If it passes testing, unattended application to prod.
I still wouldn’t do this for any critical service, but for a “move fast and break things” system like Facebook where it goes down and nothing bad happens, sure.
stuner@lemmy.world 5 days ago
It would be interesting to know what share of servers have that enabled.
I have it enabled on Debian and Ubuntu and I’m quite happy with it. But I had pretty bad experiences with reboot-less updates on other (desktop) distros.
Thaurin@lemmy.world 5 days ago
I think Debian is probably pretty conservative in their updates. I also recommend checking out the needrestart package. It will tell you when a reboot is needed because of a newer kernel that was installed, or when a systemd service needs a restart.
But as another commenter noted, outside of self hosting, in enterprise businesses environments where you manage an army of servers, things look different. But then, these guys are paid to be on-call in the weekend for events like these. :)
non_burglar@lemmy.world 5 days ago
The path to uptime is paved with understanding what broke and when.
Zwuzelmaus@feddit.org 5 days ago
php can be a real nightmare even with it’s well-attended upgrades :)
Thaurin@lemmy.world 5 days ago
Well, we’re talking (Debian’s) security updates only here, not major PHP version jumps. :)