> On Thu, Apr 09, 2020 at 11:06:45AM +0200, Nicolas Kovacs wrote: >> Which leads me to the more general question of: enable CR on a >> production >> server, yes or no? > > Not on production. Only for testing.I'm not sure. Running production environments without CR enabled means you're running without current security updates for quite some time. Seems a bad and risky idea to me. Regards, Simon
On Thu, Apr 09, 2020 at 02:40:12PM +0200, Simon Matter via CentOS wrote:> > On Thu, Apr 09, 2020 at 11:06:45AM +0200, Nicolas Kovacs wrote: > >> Which leads me to the more general question of: enable CR on a > >> production > >> server, yes or no? > > > > Not on production. Only for testing. > > I'm not sure. Running production environments without CR enabled means > you're running without current security updates for quite some time. Seems > a bad and risky idea to me.I have private staged repos, so I pick and choose what goes onto production systems, after I've tested them on non-productions systems. CR going to give you broken dependencies as this thread details. If I need to reinstall/build a new prod system, I don't want broken dependencies killing the install. -- Jonathan Billings <billings at negate.org>
On Thu, 9 Apr 2020 at 08:40, Simon Matter via CentOS <centos at centos.org> wrote:> > On Thu, Apr 09, 2020 at 11:06:45AM +0200, Nicolas Kovacs wrote: > >> Which leads me to the more general question of: enable CR on a > >> production > >> server, yes or no? > > > > Not on production. Only for testing. > > I'm not sure. Running production environments without CR enabled means > you're running without current security updates for quite some time. Seems > a bad and risky idea to me. > >Like most things in the world, there is no single answer which will satisfy all the different demands that all the environments have. You have to weigh what each environment needs in terms of confidentiality, availability, and integrity (or whatever 3 or 4 letter acronym your site uses) then answer if it is a good idea or not. If you need high availability, then you are going to set things up where testing is done first then roll out of updates is done. If you need high confidentiality, you may push out security updates more and if you need high integrity, well you probably make the waterfall model look simple in what you have to do to make sure anything changes anywhere.> Regards, > Simon > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos >-- Stephen J Smoogen.
> On Thu, 9 Apr 2020 at 08:40, Simon Matter via CentOS <centos at centos.org> > wrote: > >> > On Thu, Apr 09, 2020 at 11:06:45AM +0200, Nicolas Kovacs wrote: >> >> Which leads me to the more general question of: enable CR on a >> >> production >> >> server, yes or no? >> > >> > Not on production. Only for testing. >> >> I'm not sure. Running production environments without CR enabled means >> you're running without current security updates for quite some time. >> Seems >> a bad and risky idea to me. >> >> > Like most things in the world, there is no single answer which will > satisfy > all the different demands that all the environments have. You have to > weigh > what each environment needs in terms of confidentiality, availability, and > integrity (or whatever 3 or 4 letter acronym your site uses) then answer > if > it is a good idea or not. If you need high availability, then you are > going > to set things up where testing is done first then roll out of updates is > done. If you need high confidentiality, you may push out security updates > more and if you need high integrity, well you probably make the waterfall > model look simple in what you have to do to make sure anything changes > anywhere.My reply was to the answer "Not on production. Only for testing.". I didn't go into detail because I thought it's obvious that it's not so easy. I didn't mean to blindly feed all CR updates to production environments. In fact over here, we never ever feed any update directly from public servers to any production machine. It all comes from local repositories where we have control over what goes where and we can make sure not to blindly make updates. What I meant is that just staying away from CR for production servers sounds dangerous. You just can't if security critical updates are only available in CR. Regards, Simon