@Adnan Don't do that. You'll just encourage them.

Shit my uncle says:

> Do you guys remember 10 years ago, when all the people with gluten allergies were dying in the streets like diseased cattle?

His whole facebook feed is basically just one-liners:

> Celery is 95% water and 100% not pizza.

> Gently placing your finger on someone’s lips and saying, “Shh, not another word,” is super romantic but for some reason, the cops don’t seem to think so.

> I want to be buried with a shotgun and a box of shells. Then someday I’ll be the most bad ass zombie ever.

and so on.

@tylerl You should introduce him to Reddit.

> If history repeats itself, I’m totally getting a dinosaur.

> The pharmacist asked me my birthday again today. Pretty sure she’s going to get me something.

mornin'

@RоryMcCune Hello!

@TerryChia Hows Singapore today?

@RоryMcCune Hot.

@TerryChia We're having "fun" with lots of rain, I had a lovely 55 mile detour on the way home last night as a road got closed

So I have seen suggested on HN that Drupal should have an auto update mechanism. It was fun calling them stupid.

@RоryMcCune Heh, complete opposite of here. :)

@TerryChia yeah I think at the moment, for Internet connected systems, auto-updating and risking a bad patch is probably better than the alternative

of course then you have the challenge of securing the auto-update mechanism

@RоryMcCune Auto updates is a completely stupid thing for a server environment.

@TerryChia why do you say that?

@RоryMcCune It means giving a third party arbitrary write access to your server.

@TerryChia sure but you trust their code anyway (no-one audits drupal before using it) so if they're malicious you're screwed anyway

the risk is that they're incompetent and don't secure the auto-update properly

Also things like ubuntu do that already

where you can auto-install security patches

help.ubuntu.com/community/AutomaticSecurityUpdates

@RоryMcCune Do people honestly do that for servers?

@TerryChia ubuntu has it as a option, I'll bet people use it

they wouldn't bother providing it otherwise

@RоryMcCune But Ubuntu's primary users are desktops.

Auto updates are fine and a great solution for that situation.

@TerryChia ..... every VPS provider I've seen does ubuntu server as an option

@RоryMcCune They do, but the vast majority of Ubuntu installations are desktops.

@TerryChia [citation needed]

@RоryMcCune There are numbers, I'm just lazy to dig them up.

Plus I'll argue that even if your operating system does that it's no reason for your framework to do so as well.

Where does that end? Do you want to every single library you use to auto update?

@TerryChia realistically does any sysadmin manually assess patches before install?

I'll say no in most cases

so the difference is do I manually kick of the install

or have it done automatically

what's the difference in risk profile there?

if an update is malicious then you won't get to know either way

unless it's very stupid

@RоryMcCune You know when an update occurs if you kick it off so you can roll it back if something goes wrong.

@TerryChia sure but that's not a security issue that's a reliability issue

look at the window for Drupalgeddon, it was being exploited in hours after release.

that means that people who were asleep when it came out probably had 0 time to install a patch

@RоryMcCune Is there a meaningful distinction for this particular scenario? If something goes wrong in production it goes wrong, it doesn't matter if it's a security issue or a reliability issue.

@RоryMcCune That's just incompetence on their part. Drupal announced that there will be a security update on that particular day 5 days before.

@TerryChia of course if you were talking about the risk of a malicious update (which we were) there's a distinction

@TerryChia and you reckon on that level of warning all the sysadmins in the wrong timezone stayed up

heh

that's funny

from a security standpoint risks are. manual update, miss it/sleep in and your pwned. Automatic updates, malicious dev/incompetent dev and your pwned

trade off

@RоryMcCune If that isn't enough the system is screwed in 543647645 different ways already anyway.

@TerryChia don't follow, this is one of the first remotes that's had that level of compromise that I'm aware of

@RоryMcCune Both sucks, but in the latter scenario you are relying on someone out of your control to do things properly.

@TerryChia you are anyway, in manual install scenario you still fully trust the dev not to be incompetent

if they ship a duff update you're pwned

as I say no-one reviews the framework code before applying it

perhaps I'm wrong

some people do

but I'd wager it's less than 1% of the userbase

@RоryMcCune If a warning 5 days before from Drupal that a critical security vuln will be dropped isn't enough to keep the sysadmin up for a night to patch this that sysadmin is incompetent and has probably screwed up in many different ways already.

@TerryChia that's a view but I've worked with quite a lot of people who use these kind of CMS systems and I'm not sure many of them stay up for security updates

they might in the future now that drupalggedon has happened

but before that as I say, no-one had seen that level of attack/compromise so quickly after a release

@RоryMcCune Heartbleed? Shellshock?

And that's just this few months alone.

@TerryChia yeah I don't think shell shock had that level of impact for whatever reason

and heartbleed wasn't (in the vast majority of cases) easy server compromise

and before that I struggle to think of one that had that speed of attack/compromise

put it this way, if your theory holds then no additional systems were compromised due to drupalggedon as all the incompetent people were already pwned... I'd suggest that's not the case

@RоryMcCune Ok, so in your view where should you draw the autoupdate line?

Should everything be autoupdated?

@TerryChia well if you trust the supplier of the software (and you do) and they have a well designed auto-update mechanism in place (which would need verified) and you view the risk of compromise as higher than the risk of outage due to bad patch then yeah

it's a trade-off some people won't view those risks that way

as with everything in security, it depends

but utltimately, for me it's not about trust in the vendor 'cause everyone trusts them fully already...

@RоryMcCune And that's why everything is broken!

@TerryChia absolutely!

@RоryMcCune Ok, let's take a look at it from another perspective. I find it hard to believe that $LARGECORP with all its cumbersome processes will allow auto updates for critical business software. Is that not the case?

(I'm continuing this conversation because I'm bored and feel like arguing. :) )

@TerryChia so a large corp should have defence in depth mechanisms in place (e.g. virtual patching) and appropriate security ops to have these activated in a timely manner :)

but no a $largecorp would never in my experience automatically patch

Huh, we will be getting a Black Panther movie!

No GoTG for the next 4 years though.

Oh wait nvm, that's in 2017.

@TerryChia In my case, $LARGECOP harbours the kind of people that want to install an antivirus on an offline root CA -- a machine that never, and has never, seen either a network or a human user.

Under these conditions, everything is possible.

@ThomasPornin Well when you put it that way...

BRB buying a cave and stocking it with supplies.

@ThomasPornin That's hilarious and also sad as I can imagine and have worked for companies who would do that

If you want another data point: I rent a server. I installed Ubuntu on it. I don't automatically install security updates -- I install them promptly, but manually, and I kind-of review the patches.

So it looks like Marvel is doing 3 movies a year from 2017.

Nice bunch of new characters as well.

@RоryM Oooh, fancy! Somebody is using Bing Translate

hello

@Adnan yeah the translate button built into facebook makes it easy :)

although it really garbles a lot of things

@emberfang Hello, traveller!

basic stuff it can handle

@RоryMcCune DC is meh.

@RоryMcCune Surprisingly, it seems like it translated it quite well this time

@TerryChia I'm much more of a marvel fan myself (Marvel unlimited app on the new iPad Air 2 is awesome :) )

The Dr Strange movie should be freaking awesome.

We need more magic in the MCU. :)

All my security investigation stuff is failing recently, getting low morale :|

@emberfang This means you should give up.

yeah i feel like im not skilled at this

@AviD I got confused by SE wrapping Amazon links with themselves as click referrer, I thought that stackoverfl08-20 referrer it redirected to was simply some bogus Amazon account that was supposed to look like SE. That's why I flagged it as spam and only later realized it's redirected via rads.stackoverflow.com.

I forgot about the official SE spamify bot :)

@RоryMcCune This may amuse you. :)