XMPP Service Operators - 2023-10-11

PSA update *curl https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/

reminder that automatic updates are useless if you never reboot

I think that's an over-generalization - many updates don't require a reboot. In the case of XMPP servers, if it's a library that's been updated then a restart of the XMPP daemon may be all that's needed. In the case of a command-line tool like curl, no reboot is needed. There is libcurl though, which is used as a library by many things. Kernel updates require a reboot (generally, but even then there are ways...)

At least Debian is generally pretty good at telling you when an update needs to reboot or restart services

Does it by default? I always install needrestart for this.

Is it not installed by default? I have it most places

Weird, can't see that it is default

Just suggested by unattended-upgrades

Anyway, veering off-topic... :)

reboots are the safest way to make sure all updates are applied though

Sure. That doesn't make automatic updates useless though :)

^

one thing which *does* make your automated updates useless is if you don't monitor it :)

I had a case the other day where a server was set up with unattended-upgrades, but it hadn't updated for months because grub-pc failed to reconfigure because of some stupid device renaming issue.

that goes by silently unless you read your cron mails, and who does that.

Me, actually :P

crazy