Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never Update Anything

blog.kronis.dev

Post reply on HN
Print view View original

21–30 of 121 posts

Re: Never Update Anything

#21

Post by KronisLV »

Joel_Mckay wrote: post #17
KronisLV wrote: post #10

Oh hey, I was wondering why the VPS suddenly had over 100 load average, restarted Docker since the containers were struggling, now I know why (should be back now for a bit). Won't necessarily fix it, might need to migrate over to something else for the blog, with a proper cache, alongside actually writing better articles in the future. I don't think the article itself holds up that well, it's just that updates are of…

Alpine linux was designed for web services, as it includes the bare minimum resources necessary for deployment. https://wiki.alpinelinux.org/wiki/Nginx Also, may want to consider a flat html site if you don't have time to maintain a framework/ecosystem. =3

Alpine is pretty nice!

I did end up opting for Ubuntu LTS (and maybe the odd Debian based image here or there) for most of my containers because it essentially has no surprises and is what I run locally, so I can reuse a few snippets to install certain tools and it also has a pretty long EOL, at the expense of larger images.

Oddly enough, I also ended up settling on Apache over Nginx and even something like Caddy (both of which are also really nice) because it's similarly a proven technology that's good enough, especially with something like mod_md https://httpd.apache.org/docs/2.4/mod/mod_md.html and because Nginx in particular had some unpleasant behavior when DNS records weren't available because some containers in the cluster weren't up https://stackoverflow.com/questions/50248522/nginx-will-not-...

I might go for a static site generator sometime!

Re: Never Update Anything

#22

Post by KronisLV »

cogman10 wrote: post #13

I find it pretty funny that immediately on the first click of this article I was greeted with an internal server error.

That was me scrambling to allocate more resources to the container and redeploy it, after my alerting ticked me off about issues and I figured out what's going on. While the container itself was down, the reverse proxy returned an error.

Re: Never Update Anything

#23

Post by Joel_Mckay »

KronisLV wrote: post #21
Joel_Mckay wrote: post #17

Earlier quoted context omitted.

Alpine linux was designed for web services, as it includes the bare minimum resources necessary for deployment. https://wiki.alpinelinux.org/wiki/Nginx Also, may want to consider a flat html site if you don't have time to maintain a framework/ecosystem. =3

Alpine is pretty nice! I did end up opting for Ubuntu LTS (and maybe the odd Debian based image here or there) for most of my containers because it essentially has no surprises and is what I run locally, so I can reuse a few snippets to install certain tools and it also has a pretty long EOL, at the expense of larger images. Oddly enough, I also ended up settling on Apache over Nginx and even something like Caddy (bo…

Apache is stable for wrapping mixed services, but needs a few firewall rules to keep it functional (slow loris + mod_qos etc.) =)

Ubuntu LTS kernels are actually pretty stable, but containers are still recommended. ;)

Re: Never Update Anything

#24

Post by 0cf8612b2e1e »

apantel wrote: post #7

No no no, it’s “never update anything and don’t expose your machine to the internet”. Winning strategy right there.

If only that were possible with some appliances. I can keep my TV offline, but not the Roku. Internet connected utilities which will continually patch themselves into enshitification.

Re: Never Update Anything

#25

Post by KronisLV »

Joel_Mckay wrote: post #23
KronisLV wrote: post #21

Earlier quoted context omitted.

Alpine is pretty nice! I did end up opting for Ubuntu LTS (and maybe the odd Debian based image here or there) for most of my containers because it essentially has no surprises and is what I run locally, so I can reuse a few snippets to install certain tools and it also has a pretty long EOL, at the expense of larger images. Oddly enough, I also ended up settling on Apache over Nginx and even something like Caddy (bo…

Apache is stable for wrapping mixed services, but needs a few firewall rules to keep it functional (slow loris + mod_qos etc.) =) Ubuntu LTS kernels are actually pretty stable, but containers are still recommended. ;)

That's fair! Honestly, it's kind of cool to see how many different kinds of packages are available for Apache.

A bit off topic, but I rather enjoyed the idea behind mod_auth_openidc, which ships an OpenID Connect Relying Party implementation, so some of the auth can be offloaded to Apache in combination with something like Keycloak and things in the protected services can be kept a bit simpler (e.g. just reading the headers provided by the module): https://github.com/OpenIDC/mod_auth_openidc Now, whether that's a good idea, that's debatable, but there are also plenty of other implementations of Relying Party out there as well: https://openid.net/developers/certified-openid-connect-imple...

I am also on the fence about using mod_security with Apache, because I know for a fact that Cloudflare would be a better option for that, but at the same time self-hosting is nice and I don't have anything too precious on those servers that a sub-optimal WAF would cause me that many headaches. I guess it's cool that I can, even down to decent rulesets: https://owasp.org/www-project-modsecurity-core-rule-set/ though the OWASP Coraza project also seems nice: https://coraza.io/

Re: Never Update Anything

#26

Post by tivert »

EvanAnderson wrote: post #11
SoftTalker wrote: post #8

"In my eyes it could be pretty nice to have a framework version that's supported for 10-20 years and is so stable that it can be used with little to no changes for the entire expected lifetime of a system." This is what applications used to be like, before the web and internet hit and regular or even push updating became easy. It was simply so difficult and expensive to provide updates once the software was in the cu…

Frequent updates, in the old days, meant that a vendor had poor QA. I think that's probably still the case most of the time today, too.

> Frequent updates, in the old days, meant that a vendor had poor QA. I think that's probably still the case most of the time today, too.

The internet has normalized poor QA. The bosses don't give a shit about QA anymore because it's so cheap to just push out a patch.

I mean just look at old video game magazines that talked about the software development process: the developers would test the hell out of a game, then test the hell out of it again, because once it was burned onto a $100 cart (in 2024 dollars) it wasn't ever going to change.

Now games can remain buggy and unstable for months or even years after "release."

Re: Never Update Anything

#27

Post by n_plus_1_acc »

AaronFriel wrote: post #20

A feature I've wanted for ages, for every OS package manager (Windows, apt, yum, apk, etc.), every language's package manager (npm, pypi, etc.), and so on is to update but filter out anything less than one day, one week, or one month old. And it applies here, too. Now, some software, they effectively do this risk mitigation for you. Windows, macOS, browsers all do this very effectively. Maybe only the most cautious e…

Isn't that basically non rolling-release distros?

Re: Never Update Anything

#28

Post by KronisLV »

apantel wrote: post #7

No no no, it’s “never update anything and don’t expose your machine to the internet”. Winning strategy right there.

I know it's supposed to be a statement to take the absurd title of my article a bit further, but in some cases, I can see that being said unironically.

Nothing good would happen if some machine running Windows XP in a hospital that's hooked up to an expensive piece of equipment that doesn't run with anything else suddenly got connected to the Internet. Nor does the idea of any IoT device reaching past the confines of the local network make me feel safe, given how you hear about various exploits that those have.

On one hand, you should get security patches whenever possible. On the other hand, it's not realistic to get just security patches with non-breaking changes only. Other times, pieces of hardware and software will just be abandoned (e.g. old Android phones) and then you're on your own, even if you'd want to keep them up to date.

Re: Never Update Anything

#29

Post by eXpl0it3r »

neontomo wrote: post #18

the react module bloat example is not a fair one, the recommended way to start a react project isn't to use create-react-app. other methods are more streamlined. but then again, the deprecation of create-react-app perhaps proves the point that updates create problems.

It's not anymore the recommended way and last I checked it's not really being maintained as much as other ways, but for quite a while, it was the recommended way.

Re: Never Update Anything

#30

Post by karolist »

spyspy wrote: post #9

Kinda weird to see Java over Go, when the former is basically an entirely new language from what it was 10 years ago and the latter has made it an explicit goal to never break older versions and (almost) never change the core language.

Writing backends in Go I do get that warm fuzzy feeling knowing that it will compile and work in ten years. The syntax is easy to read, if I'm not lazy to add extensive tests I can simply read these as documentation to re-familiarise myself later. It's now my go to tool for everything server side.
Post reply on HN