stuner

It would be interesting to know what share of servers have that enabled.

I have it enabled on Debian and Ubuntu and I’m quite happy with it. But I had pretty bad experiences with reboot-less updates on other (desktop) distros.

Agreed.

You almost need an AI agent in a sandbox to download and run all the POCs to weed out the fake ones until one of them becomes well known.

Sounds like a good malware vector to target security researchers…

Yeah, assuming everyone installed the patch is quite optimistic. But censys probably also undercounts the number of fixed systems, as some Linux distros (e.g., Ubuntu) don’t change the version when shipping security fixes. I’m running the sury.org package which would report as 7.4.33 but has been patched. Still it looks like there’s tons of unpatched services.

Yes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.

So it seems like it was rather easy for an IT security professional to create an exploit within 24h of the disclosure. Not sure if every script kiddy can do it, but this means that there are certainly malicious people/organizations who can.

Ultimately, it seems to me that the only real choice is to patch our (public) systems ASAP these days.

I think for me spin-down was working initially. But then I added some Docker containers and those could only be run on the HDDs, blocking spin down. With Debian I just put the containers on the smaller SSD, allowing the HDDs to spin down.

I like being able to drop in whatever disk I need to for expansion or replacement.

I didn’t move that far away (to Debian + ZFS), so that limitation still remains. Although the addition of Raid-Z expansion should alleviate things quite a bit.

My NAS/home server takes about 180 kWH/year, or 20W on average (costs me about 5 Euro/month). This feels like a lot to me and makes up a good chunk of my total energy usage.

What I did to optimize it is mostly select a “low-power” x86 platform, and limit the number of disks. I also decided not to use TrueNAS because it couldn’t let the disks from going to sleep.

The machine hosts 10 TB of usable storage (+RAID 1), syncthing, immich, file server, Influx DB, Grafana, and a few other services.

Debian also supports “unattended-upgrades”: wiki.debian.org/PeriodicUpdates

I actually have it set up the same way on both: Automatically install updates (and restart some services), but don’t reboot. I don’t think it was different/easier on Ubuntu.

Overall, the two distros are very similar for a server application. If you’re already running Debian on your PC, I would also go with that for a server.