Puppy Linux Discussion Forum Forum Index Puppy Linux Discussion Forum
Puppy HOME page : puppylinux.com
"THE" alternative forum : puppylinux.info
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

The time now is Mon 16 Jul 2018, 08:10
All times are UTC - 4
 Forum index » Off-Topic Area » Security
Automatic updates
Post new topic   Reply to topic View previous topic :: View next topic
Page 1 of 6 [77 Posts]   Goto page: 1, 2, 3, 4, 5, 6 Next
Author Message
mavrothal


Joined: 24 Aug 2009
Posts: 2971

PostPosted: Wed 29 Oct 2014, 05:56    Post subject:  Automatic updates  

I recently suggested that puppy may go for automatic notifications for updates and zigberd thought that this is not a good idea. Very windows-like.

The recent Linux bugs in security (hearbleed and shelshock) triggered a couple of relevant threads also in this forum indicating that there is a need for such a thing in this community too.

Not only windows and macs but every major linux distribution has a system in place to check for updates and prompt the user to update.
Most of those and also provide the option to automatically update.
Is a matter of security and stability of the system.

However, such a system does require the user to authorize (once) automatic connection and status-check with ibilio.org.

What do you think? Should future puppies include this security/stability/bugfix feature or should the individual user should be responsible of checking regularly for updates and bugfixes?

Take the poll Exclamation

In conclusion: It would appear that a considerable number of puppians freak out on anything "automatic". So I just put some code out for anyone that may want to use it and put the matter to rest...

_________________
== Here is how to solve your Linux problems fast ==

Last edited by mavrothal on Sat 20 Dec 2014, 11:10; edited 2 times in total
Back to top
View user's profile Send private message 
James C


Joined: 26 Mar 2009
Posts: 6725
Location: Kentucky

PostPosted: Wed 29 Oct 2014, 07:03    Post subject:  

I voted yes ...... as long as it is a "opt in" choice.
Back to top
View user's profile Send private message 
8Geee


Joined: 12 May 2008
Posts: 1595
Location: N.E. USA

PostPosted: Wed 29 Oct 2014, 07:32    Post subject:  

Haven't voted yet.

1.) Security updates bash, openssl, GNUtls, etc YES
2.) EVERYTHING ELSE NO

However, not all security updates are for just any puppy. There are lib dependency, compatible version, etc. limitations. I would ask others to also review the bash update/concerns threads in the security section here. There are several versions, due to several versions of puppy.

So even though 1.) gets a yes, it comes with some inherent limitations, such as proper version for the puppy-in-use.

As the poll is written, I would have to say NO, due to non-specificity of request. For example, I might not want updates to browsers/search unless manual... its not specified (blanket statement = NO, security = YES)

edit: After writing the above, it dawned on me, that even with the bash/ssl problems recently, I still had to do an about:config using FF and change A LOT of stuff to make sure the BROWSER complied with the OS.

_________________
Linux user #498913

Some people need to reimagine their thinking.
Back to top
View user's profile Send private message 
JustGreg

Joined: 24 May 2005
Posts: 785
Location: Connecticut USA

PostPosted: Wed 29 Oct 2014, 07:41    Post subject:  

My vote is No. Automatic updates can be a real pain. The automatic update process requires a "phone home" on a regular basis with the ability to change the system from an external source. Just look at the number of Micro$oft updates that cause problems.

Maintenance of a computer is like that of a car. The owner has the responsibility of keeping it running. If you want to turn maintenance over to a third party, then be prepare for new problems and a cost. Remember Murphy's law, if it can go wrong then it will.

_________________
Enjoy life, Just Greg
Live Well, Laugh Often, Love Much
Back to top
View user's profile Send private message 
dejan555


Joined: 30 Nov 2008
Posts: 2806
Location: Montenegro

PostPosted: Wed 29 Oct 2014, 08:02    Post subject:  

Automatic updates would be usefull, I guess the way it's implemented would dictate if it's windows-like or not. The user should retain control for sure, and maybe not make it a default from the first boot, or add it to the first (welcome) setup screen so user can choose to turn it on.
Even if it's on, it can be configured to notify user first about updates and ask to apply them.
So as long as it's configurable and could be totally turned off and allow user to use puppy in a classic way then why not?

Also, an idea - instead of downloading updates as pets and installing in savefile deltas could be used to update core parts - system packages by modifying main sfs and keep user-installed pets in savefile.
This is kind of how I've been updating dpup since version 487 but it's not yet automated, instead I attach a separate script for each update in dpup487 thread, but I've been thinking of modifying it so user can just type "update" in console and check/isntall updates.

EDIT: To further explain my preference of updating sfs - for example you get a browser with puppy that's in main sfs, but when you upgrade to new version it takes double the space in your savefile and still keeping the old version in sfs - and if you boot with pfix=ram updates are gone.

_________________
puppy.b0x.me stuff mirrored HERE or HERE
Back to top
View user's profile Send private message Visit poster's website MSN Messenger 
mavrothal


Joined: 24 Aug 2009
Posts: 2971

PostPosted: Wed 29 Oct 2014, 08:28    Post subject:  

James C wrote:
I voted yes ...... as long as it is a "opt in" choice.


Always in Puppy Cool
For start I was thinking to check for service packs that puppy is using some time now (mostly BK's puppies) and the option to be presented at quicksetup with the default to "off". See picture
Updates.jpg
 Description   
 Filesize   134.16 KB
 Viewed   923 Time(s)

Updates.jpg


_________________
== Here is how to solve your Linux problems fast ==

Last edited by mavrothal on Wed 29 Oct 2014, 09:25; edited 1 time in total
Back to top
View user's profile Send private message 
raffy

Joined: 25 May 2005
Posts: 4839
Location: Manila

PostPosted: Wed 29 Oct 2014, 08:41    Post subject: goal  

Easy update is one of Barry's goals for Quirky, and pet format is being used, so at least for Quirky, the question has been answered.

EDIT: Should it be automatic or manual? Let the user decide.

Last edited by raffy on Wed 29 Oct 2014, 08:44; edited 1 time in total
Back to top
View user's profile Send private message 
mavrothal


Joined: 24 Aug 2009
Posts: 2971

PostPosted: Wed 29 Oct 2014, 08:42    Post subject:  

8Geee wrote:

1.) Security updates bash, openssl, GNUtls, etc YES
2.) EVERYTHING ELSE NO

The udates will always be puplet specific and will be issued by the puplet developer. Could be a service pack as in Barry's Precise Pup and Quikies, or a quickpet udate as in TahrPup.

Puppies layered filesystem is not appropriate for continuos updates as Windows, Mac of Fedora/Ubuntu. But rather small emergency updates.
As a matter of fact I think the best update would be to update the main SFS through a delta file, instead of many small or few bigger pet additions.

But all these are secondary.
The main question is if the Puppy developer decides that certain files in the puppy that (s)he build must be updated and provides an update, should (s)he just announce it in the forum and exect people to see it and update or should the puppy user have the option to check automatically for such an update?

_________________
== Here is how to solve your Linux problems fast ==
Back to top
View user's profile Send private message 
mavrothal


Joined: 24 Aug 2009
Posts: 2971

PostPosted: Wed 29 Oct 2014, 08:44    Post subject: Re: goal  

raffy wrote:
Easy update is one of Barry's goals for Quirky, and pet format is being used, so at least for Quirky, the question has been answered.
EDIT: Should it be automatic or manual? Let the user decide.


We are discussing the "automatic check" part. Not really the format (pet, delta tarball etc).
The user can decide only if the option is provided.
Surprisingly at least half of the voters (as it stands now) do not want to have an option Shocked Themselves or anybody else!

_________________
== Here is how to solve your Linux problems fast ==
Back to top
View user's profile Send private message 
perdido


Joined: 09 Dec 2013
Posts: 836
Location: ¿Altair IV , Just north of Eeyore Junction.?

PostPosted: Wed 29 Oct 2014, 09:46    Post subject:  

Automatic updates disabled by default.
Maybe option to update one time only, some like this on 1st install.
Have updates available via PPM so could select which updates wanted.

Not a fan of magic windows telling me to update.

I vote no.
Back to top
View user's profile Send private message 
dejan555


Joined: 30 Nov 2008
Posts: 2806
Location: Montenegro

PostPosted: Wed 29 Oct 2014, 09:56    Post subject:  

Puppy was never mimicing windows, not sure why don't users look at this as a puppy-specific feature.
I never updated windows either, since it never tells me what is updating, why or when it's going to do it. It's no wonder that with windows you always feel insecure or like you don't know what you're doing.
With puppy user is in control and has choice.
Updates could also have an info/changelog so user can review changes before update.

_________________
puppy.b0x.me stuff mirrored HERE or HERE
Back to top
View user's profile Send private message Visit poster's website MSN Messenger 
saintless


Joined: 11 Jun 2011
Posts: 3882
Location: Bulgaria

PostPosted: Wed 29 Oct 2014, 12:30    Post subject:  

Option is when you have 10 updates/fixes like:
Code:
1. Update/fix 1 (description...) - yes or no?
...........................................
10. Update/fix 10 (description...) - yes or no?

When you get for the same 10 fixes option to update all or nothing and especially without making clear what exactly each update/fix does - then it is exactly the way Windows does automatic updates.
On the other hand almost every updated OS includes new bugs for fixing and some of them are exactly because the update.
User choice means - the user will make the choice what to update/fix or not.

Just an example from Debian:
apt-get install /included-package-name - will install newer version of the package (if there is availble newer version).
apt-get upgrade - install newer versions (if available) of all installed packages.
apt-get dist-upgrade - upgrade the system to next version (squeeze to wheezy, or wheezy to jessie...).

Example what I do not like to update from Debian and why:
Updated version of default kernel - breaks booting to desktop for some of my machines.

This is user choice.

_________________
Farewell, Nooby, you will be missed...
Back to top
View user's profile Send private message MSN Messenger 
gcmartin

Joined: 14 Oct 2005
Posts: 6730
Location: Earth

PostPosted: Wed 29 Oct 2014, 13:39    Post subject:  

@ETP, @BarryK, @666PhilB, and other distro develops understand the importance of such a feature so that their distros operate in a fashion as they intend.

They do this for their "pride of work" as they, as many developers do, strive for some semblance of perfection in their efforts.

I see nothing wrong with a "standard" feature available to each and every developer with their WOOFCE generations to have this built-in. This way in a very short period of time, most every community member user would see the same utility function to their advantage and selection. Thus, in seeing the same thing across distros, the understanding would be consistent.

None of us are perfect, as this does provide a mechanism to address oversights that occur and items sometimes missed.

This would be a positive plus for PUPs coming out of Puppyland, from my point of view. I do recognize the potential of negative behavior which could result,but NO DEVELOPER strives to generate negative behavior in their work. So, from that standpoint of the pride that they bring to the table, we should expect all of the advantages of such with little/few/no occurrences of the disadvantages.

The idea of such a utility is that this is NOT a user service. It is a DEVELOPER Service extended by developers, which allows users to take advantage of. EVERY distro developer strives for perfection. This mechanism allow the distro to perfect that, as safely as possible and as consistently as possible.

Simply thoughts to consider.

_________________
Get ACTIVE Create Circles; Do those good things which benefit people's needs!
We are all related ... Its time to show that we know this!
3 Different Puppy Search Engines or use DogPile

Last edited by gcmartin on Wed 29 Oct 2014, 14:06; edited 1 time in total
Back to top
View user's profile Send private message 
mavrothal


Joined: 24 Aug 2009
Posts: 2971

PostPosted: Wed 29 Oct 2014, 13:56    Post subject:  

All please look at the poll question once more.

This is not about automatic updates!
This is about user-authorized automatic check for updates. Update installation still requires user approval.
The question really is, "do you want the option to be informed automatically or not?"

(I clarify this because I admit is hard to believe that so many puppians appear not to want the option to be informed Confused )

_________________
== Here is how to solve your Linux problems fast ==
Back to top
View user's profile Send private message 
watchdog

Joined: 28 Sep 2012
Posts: 1597
Location: Italy

PostPosted: Wed 29 Oct 2014, 14:53    Post subject:  

My thought is: keep it simple, keep it manual, keep it static. An updated puppy should be a new puppy. I voted "NO" but if a user-authorized check for updates is released for next puppies than I don't worry: I can use or not use it. I see the danger that users will feel too protected by developers without learning about security issues and linux in general. Noobies will be more protected and will get more easily bugfixes but will they learn to be responsible and active to understand the system they are using? I learned a lot about linux and IT working around bugs and hardware drivers issues and reading the forum. If developers do all the job you steal to us our game. In my humble opinion.
Back to top
View user's profile Send private message 
Display posts from previous:   Sort by:   
Page 1 of 6 [77 Posts]   Goto page: 1, 2, 3, 4, 5, 6 Next
Post new topic   Reply to topic View previous topic :: View next topic
 Forum index » Off-Topic Area » Security
Jump to:  

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
[ Time: 0.3757s ][ Queries: 13 (0.0249s) ][ GZIP on ]