freebsd stable - May 2019 - FreeBSD flood of 8 breakage announcements in 3 mins.

> On May 15, 2019, at 12:12 PM, Will Andrews <will at firepipe.net>
wrote:
> 
> On Wed, May 15, 2019 at 10:45 AM Julian H. Stacey <jhs at
berklix.com> wrote:
> 
>> Batching also means some of these vulnerabilities could have been
>> fixed earlier & less of a surge of demand on recipient admins time.
>> 
>> An admin can find time to ameliorate 1 bug, not 8 suddenly together.
>> Avoidance is called planning ahead. Giving warning of a workload.
>> Like an admin plans ahead & announces an outage schedule for
planned
>> upgrade.
>> 
>> Suddenly dumping 8 on admins causes overload on admin manpower.
>> 8 reason for users to approach admin in parallel & say
>> "FreeBSD seems riddled, how long will all the sudden unplanned
>> outages take ?  Should we just dump it ?"
>> Dont want negative PR & lack of management.
>> 
> 
> What admins prefer 8 downtime events instead of 1?
> 
> ?Will.
Exactly. If batching 8 (or more) individual bugs/issues together into one
release is really causing admin/manpower overload and angst, then maybe it?s
time in your situation to use the binary updates (which would only be a single
`freebsd-update` and reboot, so there would be no ?sudden unplanned outages?)
rather than tracking src and remediating each individual bug at a time. I
understand that might be mutually exclusive with other reasons why you don?t
already use binary updates or prefer to track src for the base system, but there
are always compromises and trade-offs to everything, and batching seems
preferable to any alternatives.

You?d seriously want to run reboots across a server fleet every other day for
two weeks if there were 8 separate patches staggered out? That?s insanity, and
is way more of a PR problem from a ?should we just dump it? perspective. You
mention ?announces an outage schedule for planned upgrade?, but that?s really
its own form of internal batching ? it shouldn?t make any difference if you?re
technically pushing 1 or 8 bug/security fixes during that pre-identified period
of time: all of your other internal processes like maintaining a test group for
detecting regressions, using boot environments (or other storage features) to
allow for rollbacks, etc. all continue to work as intended.

Any potential negative PR within your company/organization seems like it would
be related to how else you?re handling the upgrade process(es), not whether the
fixes are batched or not. Whatever other negative things you can say about them,
I don?t hear enterprise admins begging that Microsoft/Oracle/whoever would
dribble out patches one at a time each week instead of combining them like they
do; it seems like it works just fine for everyone else.


?\_(?)_/?


Thanks,
?
Matt Garber

On 5/15/19 6:16 PM, Matt Garber wrote:
> Exactly. If batching 8 (or more) individual bugs/issues together into
> one release is really causing admin/manpower overload and angst,then
> maybe it?s time in your situation to use the binary updates (which
> would only be a single `freebsd-update` and reboot, so there would
> be no ?sudden unplanned outages?) rather than tracking src and
> remediating each individual bug at a time.
Maybe I'm dumb, but I still don't get what "src vs binary" has
to do
with "8 vs 1"...
I ran a single "svn update; make buildworld; make kernel; make 
installworld; reboot", not 8...

  bye
	av.

Thanks Will,
You make some good points, but all depend on variant circustances.

I prefer to be informed ASAP, to make my own decisons with max info ASAP,
Not delayed.  I want freebsd.org to Not Delay fix announcements into batches.

If other admins want to delay being told told to do upgrades until
there's lots more to consider & upgrade, they can dummy the delay
their receive end, just filtering announcements into their own
special box they read once per period.

As soon as exploits are in the wild, some will exploit,
not announcing until binary updates are ready gives black hats more time.

>  Whatever other negative things you can say about them, I don't hear
enterprise admins begging that Microsoft/Oracle/whoever would dribble out
patches one at a time each week instead of combining them like they do; it seems
like it works just fine for everyone else.
MS make lots of money from the addicted cluless, despite MS loosers
frequently complain eg that PCs are locked up again in mid auto
update & owner can't shut down to catch a plane or train. MS servers
I avoid like the plague.

PS Here seems (*) an example of something in text config didnt even
need to wait for src/ let alone bin. * Not sure, I'll try it later,
got to dash off line.

https://lists.freebsd.org/pipermail/freebsd-announce/2019-May/001878.html
] IV.  Workaround
] Use 'restrict noquery' in the ntpd configuration to limit addresses
that
] can send mode 6 queries.

Cheers,
Julian
-- 
Julian Stacey, Consultant Systems Engineer, BSD Linux Unix, Munich Aachen Kent
 http://stolenvotes.uk  Brexit ref. stole votes from 700,000 Brits in EU.
 Lies bought; Groups fined; 1.9 M young had no vote, 1.3 M old leavers died.