Ubuntu Livepatch Reviews and details

Social recommendations and mentions

• Is kexec safe?

  There are some in-place kernel patching tools, i.e. `kpatch`, [livepatch](https://ubuntu.com/security/livepatch), and some other proprietary solutions, but they're for narrow targeted patching of security issues mostly and not for all out replacement of the running kernel. Source: about 1 year ago

• Apple has just released the first Rapid Security Response for Ventura

  > Anything that involves system services This is not true. NixOS, as one example, is able to figure out which services (including system) need to be restarted. > god forbid the kernel This is not true either. Live kernel updates are possible (but are usually a paid addition, e.g. https://ubuntu.com/security/livepatch). - Source: Hacker News / about 1 year ago

• What are you using for patch management?

  For patching running kernels against CVEs when you can't immediately reboot, there's Livepatch as well. Source: over 1 year ago

• So I'm back to Ubuntu LTS

  For security updates, yes, not for everything. See here: https://ubuntu.com/security/livepatch. Source: over 1 year ago

• Any advantage to Ubuntu Pro Desktop?

  Ubuntu Pro is how you get Kernel Livepatch which applies security fixes to your running kernel without needing to reboot. Source: over 1 year ago

• My tiny home lab setup, i5 6500T, 8GB RAM, 240GB SSD EXT4FS boot, 2TB x 2 ZFS Mirrored. This replaced similar setup done over 8 years ago with Windows and Storage Spaces.

  Ubuntu has a livepatch feature that patches critical kernel vulnerabilities at runtime but in general I would still reccomend rebooting. Source: over 1 year ago

• Red Hat Enterprise Linux (RHEL) 9 is now generally available (GA)

  Oracle snagged (developed) the first (for Linux) ksplice; https://ksplice.oracle.com/ canonical pay walled the second (free for "personal" use): https://ubuntu.com/security/livepatch Kpatch was/is the open, not-patent encumbered version (IIRC) - I thought RedHat had offered some version for years? - Source: Hacker News / almost 2 years ago