Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Ask Slashdot: Should Hosting Companies Have Change Freezes?

Soulskill posted about 2 years ago | from the what-about-change-burns dept.

Security 138

AngryDad writes "Today I received a baffling email from my hosting provider that said, 'We have a company-wide patching freeze and we will not be releasing patches to our customers who utilize the patching portal for the months of November and December.' This means that myself and all other customers of theirs who run Windows servers will have to live with several critical holes for at least two months. Is this common practice with mid-tier hosting providers? If so, may I ask Eastern-EU folks to please refrain from hacking my servers during the holiday season?"

cancel ×

138 comments

Sorry! There are no comments related to the filter you selected.

Green light (4, Funny)

michaelmalak (91262) | about 2 years ago | (#42060931)

If so, may I ask Eastern-EU folks to please refrain from hacking my servers during the holiday season?

At least 10 countries [answers.com] have just been given the green light for hacking.

What Ever You Have to Say About Hostess Company (2, Funny)

Jeremiah Cornelius (137) | about 2 years ago | (#42061187)

It's just too late. No more Twinkies.

And if you are concerned about freezing them, as the article seems to state? Don't bother. The shelf-life is astronomical!

Re:What Ever You Have to Say About Hostess Company (1)

SomePgmr (2021234) | about 2 years ago | (#42061419)

25 days. I know you were joking but I was curious.

Re:What Ever You Have to Say About Hostess Company (0)

Anonymous Coward | about 2 years ago | (#42062409)

WTF does this have to do with the topic? You may as well have posted "Sceond Psot"

Re:What Ever You Have to Say About Hostess Company (1)

WhatAreYouDoingHere (2458602) | about 2 years ago | (#42063639)

You don't see the connection? The summary mentions "hosting", which is obviously a reference to hostess twinkies. Furthermore, the word "freezes" is in the summary title, which could only indicate the process of freezing a hostess twinkie. I mean, what else could these terms mean on a slashdot story?

Re:Green light (0)

Anonymous Coward | about 2 years ago | (#42061261)

Provided you define Eastern-European as outside of EU. But that includes Switzerland, which is Western, and doesn't include Romania, where a large portion of hackers are.

Re:Green light (2)

xaxa (988988) | about 2 years ago | (#42062193)

No, that list includes 18 countries. The 10 that are eastern are:

Serbia
Montenegro
Croatia
Bosnia-Herzegovina
Macedonia (Former Yugoslav Republic of)
Albania
Belarus
Moldova
Russia
Ukraine

(The first few would often be called southeastern.)

windows? what were you thinking? (5, Insightful)

Anonymous Coward | about 2 years ago | (#42060943)

Using windows to provide an internet facing service was the first mistake.

It's not that bad (5, Funny)

bigtrike (904535) | about 2 years ago | (#42060985)

The server will be spending 50% of its life rebooting to apply minor updates and install software, reducing the risk of a security breach.

Re:windows? what were you thinking? (4, Insightful)

gavron (1300111) | about 2 years ago | (#42061181)

What he said.

I'm sorry the Windows-mods modded it down. It's instructional and it's informational. NOBODY should EVER use windows servers as Internet-facing devices.

Sorry, mods. Reality suggests the 0 is your score for having a clue.

E

Re:windows? what were you thinking? (2)

erroneus (253617) | about 2 years ago | (#42061263)

Seriously. Even Windows-only people should know this. If they aren't placing protective devices in front of their Windows boxes to control access and limit the damage of attacks, they just aren't in touch with reality.

The funny thing is that most of these security appliances are running... what?

Re:windows? what were you thinking? (3, Funny)

Anonymous Coward | about 2 years ago | (#42061293)

Exchange

Re:windows? what were you thinking? (4, Interesting)

MightyMartian (840721) | about 2 years ago | (#42061541)

Well, I do have OWA open to the world, mainly because of ActiveSync, but the actual SMTP server, no way. I've seen joe job and dictionary attacks bring an Exchange server running on damned heavy hardware brought to its knees. I run a Postfix server running postgrey, SpamAssassin and ClamAV that sits on port 25 and weeds out all the nasty bits and hands everything else off to Exchange. There's no way in hell I'd ever let Exchange's SMTP service feel the full force of what the nastier folks on the tubes can throw at it. If someone DDoSs Exchange's IIS daemon, oh well.

Re:windows? what were you thinking? (4, Informative)

Penguinisto (415985) | about 2 years ago | (#42061819)

No effing way. Only a complete and total newbie would even contemplate that, and I'd fire the first admin who tried to put such a thing in place.

Exchange as an MTA sits behind firewalls and a spam filter (be it home-brewed atop a Linux machine, or an automated commercial appliance, e.g. Barracuda). OWA you put in its own DMZ, insulated on all ends by industrial-grade firewall/security devices. Even Microsoft anticipated that one, and allows you to rig it exactly like that (with the MTA and all other bits buried in your internal network).

Back to TFA, I'm curious as to what's stopping the article submitter from sticking in a simple SCCM** box (or at least script something in Powershell that ties into Windows Update) and do his own %}$#@! patching? Relying on anyone other than the OEM to do patches is kinda, well, dumb.

.
** I know, I know - SCCM blows goats. But it's not like it's completely impossible to set up, and besides - that's the price you pay for using so much Windows gear.

Re:windows? what were you thinking? (1)

budgenator (254554) | about 2 years ago | (#42062825)

Back to TFA, I'm curious as to what's stopping the article submitter from sticking in a simple SCCM** box (or at least script something in Powershell that ties into Windows Update) and do his own %}$#@! patching? Relying on anyone other than the OEM to do patches is kinda, well, dumb.

.
** I know, I know - SCCM blows goats. But it's not like it's completely impossible to set up, and besides - that's the price you pay for using so much Windows gear.

Shared hosting? Not sure if windows can do that, but that would explain why patching might be terminated. I recall a few PHP upgrades that broke a lot of things on LAMP stacks.

Re:windows? what were you thinking? (1)

theArtificial (613980) | about 2 years ago | (#42063893)

Not sure if windows can do that, but that would explain why patching might be terminated.

I think we'll have seen everything by that point. The only Windows servers I've seen are either VPS or dedicated machines.

I recall a few PHP upgrades that broke a lot of things on LAMP stacks.

Sounds like someone didn't do their unit tests. The same thing can happen with any software which hasn't been vetted. Most shared hosts support multiple versions of PHP.

Re:windows? what were you thinking? (0, Troll)

Kjella (173770) | about 2 years ago | (#42061775)

Linux isn't going to save you from a stupid hosting company who stops updating their servers for two months so they don't have to deal with regressions. At which point you're probably going to tell me Linux doesn't have idiot admins, doesn't have regressions or doesn't have exploits. It's no miracle cure and the whole "switch to Linux and all your problems will disappear" is getting seriously old. Lots and lots of people have tried Linux over the last decade if not longer, why is Windows still doing fine in the server room? [Insert wild conspiracy theory here, including a rant of anti-competitive behavior and pretty much everything including the kitchen sink except making a decent product.] I went back to Windows after fighting Linux a few years and I wonder if the people here have actually tried it recently or just foam around the mouth by default when someone mentions Microsoft.

Re:windows? what were you thinking? (0, Flamebait)

gavron (1300111) | about 2 years ago | (#42061965)

No. Everyone else who switched to linux is doing fine. It didn't work for you and somehow this translates to the whole industry, or that everyone else is crazy and foam at the mouth.

The world runs on Linux servers. I'm sorry your experience didn't bear that out. It's ok. Not everyone is cut out to be a server admin. Only idiots use Windows.

I guess you know your place now.

E

Re:windows? what were you thinking? (0)

Anonymous Coward | about 2 years ago | (#42062227)

It apparently didn't work for Sony, either...

relying upon technology to provide your security over good practices is massive fail, regardless of the technology..

Re:windows? what were you thinking? (0)

Anonymous Coward | about 2 years ago | (#42062237)

Yep. My network is 99.9% GNU/Linux and 0.1% Microsoft Windows.

RackSpace aren't stupid, just ignorant. (0)

Anonymous Coward | about 2 years ago | (#42062101)

Also host with them, good luck :)

Re:windows? what were you thinking? (1)

Anonymous Coward | about 2 years ago | (#42062115)

You know, you could have just said that you are not qualified to administer a server. Would've been a lot shorter.

Re:windows? what were you thinking? (4, Insightful)

dbIII (701233) | about 2 years ago | (#42062883)

Since in this case you can patch without reboots, the answer is just switching to linux (or anything else that can patch without reboots) CAN solve the problem.
Of course it doesn't solve every server problem, but nobody above said it would, just you dishonestly shifting the goalposts and pretending it's no good unless it fixes problems that were not even being discussed here. That's a bit of a slimy little tactic IMHO so you must feel very strongly if you are prepared to lower yourself to that level, but let's keep all the mindless emotive fanboy bullshit out of it since it just makes you look like more of an idiot than you actually are.

Re:windows? what were you thinking? (0)

ApplePy (2703131) | about 2 years ago | (#42061359)

But how else is one to serve ASP.NET pages powered by IIS and SQL Server?

And what, pray tell, could possibly replace those singular technologies?

And don't give me that stuff about Linux! How can an OS be secure when they just let anyone look at the source code whenever they want?! Crazy talk!

/silly

I have to somewhat shamefully admit, my employer sells hosted Windows servers and space to customers (only upon request so customers can't get mad that we sold them crap). They're profitable. But we don't use them.

Re:windows? what were you thinking? (1)

Anonymous Coward | about 2 years ago | (#42061467)

Actually, it really is a shame that you can't reliably host .Net applications out of Apache on Linux. I know mod_mono made some headway into this, but it'd be huge if this were possible in a real, production ready way.

http://www.mono-project.com/ASP.NET [mono-project.com]

Re:windows? what were you thinking? (1)

Penguinisto (415985) | about 2 years ago | (#42061833)

I'm afraid you'll have to take that complaint up with Microsoft - they're the ones who lock it into Windows so tightly and refuse to work towards compatibility with other platforms, after all. *shrug*

Re:windows? what were you thinking? (1, Interesting)

GNUALMAFUERTE (697061) | about 2 years ago | (#42062605)

Why the hell would you want to code in asp in the first place?

Years ago (circa y2k) I worked for a hosting company as a sysadmin. We had some customers that demanded ASP support (less than 10%), and we tried a solution, I think it was called chilliasp, that was essentially a classic ASP implementation for Apache on Linux. It was able to run simple stuff, but complex sites failed. So my boss insisted on getting some windows servers. We ended up running 2 NT4 servers. Those 2 servers took more effort to administrate than our +30 LAMP boxes. In the years I worked there, we had 6 security breaches, and 4 of them were on windows. Of course, the security breaches we had on windows where MAJOR (as in, they took over the entire server), while the 2 security breaches we had on Linux weren't really Linux vulnerabilities, but vulns on phpnuke installations our customers left wide open and unpatched, so those only affected a single site.

I don't get why people would want to code in ASP, what does it have that Perl or PHP don't? I mean, besides expensive licenses, platform restrictions, and huge security issues.

Re:windows? what were you thinking? (1)

JDG1980 (2438906) | about 2 years ago | (#42062799)

Why the hell would you want to code in asp in the first place?

I don't get why people would want to code in ASP, what does it have that Perl or PHP don't? I mean, besides expensive licenses, platform restrictions, and huge security issues.

"Classic" ASP sucks ass. It's basically Visual Basic for Servers.

ASP.NET, however, is actually a pretty good platform, since it lets you write your server-side code in C#. While PHP does give you the advantage of a free (in both senses) platform, it isn't nearly as well-designed or as elegant as ASP.NET. It's fine for small projects and it can, with difficulty, be scaled up for large ones (there are real-world examples aplenty), but if you are designing a big project from the ground up, ASP.NET might be a reasonable choice.

Re:windows? what were you thinking? (1)

theArtificial (613980) | about 2 years ago | (#42063957)

It's fine for small projects and it can, with difficulty, be scaled up for large ones (there are real-world examples aplenty), but if you are designing a big project from the ground up, ASP.NET might be a reasonable choice.

While I know it wasn't all ASP.net are we talking London Stock Exchange big [computerworld.com] ? There are some additional hidden costs when using a Microsoft tool chain such as SQL Server [microsoftstore.com] license(s) and Windows Server license(s). If you're designing a big project this is where Java shines (I'm not a Java guy either). At the end of the day they're tools to get the job done and infrastructure considerations are part of the project.

Re:windows? what were you thinking? (0)

Runaway1956 (1322357) | about 2 years ago | (#42064155)

How can an OS be secure when they just let anyone look at the source code whenever they want?! Crazy talk!

Sometimes, you simply have to believe the empirical evidence that is available. *nix servers are seldom hacked, Windows servers are frequently hacked. No matter what you like or don't like, no matter what you understand or don't understand, a mountain of empirical evidence says that *nix operating systems are better for serving.

A large number of us also believe that *nix is a superior desktop and workstation OS, as well, but we lack the mountains of empirical evidence that we have for servers.

Are *nix servers more secure because they are open source, or in spite of being open source? Personally, I buy into the "many eyes" thing. The more people who are looking for vulnerabilities, the better. With Windows, only Windows and the bad guys are looking for those vulnerabilities. Seems that Windows loses as often as not.

Re:windows? what were you thinking? (1)

Anonymous Coward | about 2 years ago | (#42061371)

The hosting provider is most likely trying to deal with obstacles caused by the terrible windows infrastructure. I imagine they aren't freezing because they feel like being lazy, there is probably a large amount of overheard and cleanup when windows patches are rolled out (especially when they break things).

Re:windows? what were you thinking? (1)

History's Coming To (1059484) | about 2 years ago | (#42061443)

They're probably just planning on upgrading to Windows 8 and trying to find the "start server" button. (I know, I know, a cheap and innacurate shot, couldn't resist, please mod away.)

Re:windows? what were you thinking? (0)

Anonymous Coward | about 2 years ago | (#42061573)

How else will "researchers" discover and test exploits?

Re:windows? what were you thinking? (1)

JDG1980 (2438906) | about 2 years ago | (#42062747)

Using windows to provide an internet facing service was the first mistake.

What would you suggest if someone wants to run ASP.NET code on their website?

Re:windows? what were you thinking? (2)

aiht (1017790) | about 2 years ago | (#42063023)

Using windows to provide an internet facing service was the first mistake.

What would you suggest if someone wants to run ASP.NET code on their website?

Reverse proxy.

Re:windows? what were you thinking? (1)

Hognoxious (631665) | about 2 years ago | (#42064519)

Using windows to provide an internet facing service was the first mistake.

Correction, it's the second.

What would you suggest if someone wants to run ASP.NET code on their website?

I>That's the first.

DrrrrTISH!

Why Eastern European? (0)

Anonymous Coward | about 2 years ago | (#42060951)

I am Eastern European, and strangely I feel offended by that :)

But to be honest, yeap, you're pretty much asking for it...

Sure (4, Funny)

Capt.DrumkenBum (1173011) | about 2 years ago | (#42060965)

may I ask Eastern-EU folks to please refrain from hacking my servers during the holiday season?

Just reply to this message with the IP addresses of any servers you want to make sure will not be hacked and I will make sure the list gets to the right people.

Happy to help.

Re:Sure (2)

phorm (591458) | about 2 years ago | (#42061105)

127.0.0.1 ::1
fe00::0
127.0.0.2

Re:Sure (2)

houghi (78078) | about 2 years ago | (#42061407)

127.31.33.7
HTH. HAND.

216.34.181.45 (5, Funny)

kf6auf (719514) | about 2 years ago | (#42062997)

Whatever you do, don't take down 216.34.181.45.

Re:Sure (1)

antdude (79039) | about 2 years ago | (#42063349)

Here it is: 127.0.0.1

Thanks! :)

change freeze (5, Informative)

Anonymous Coward | about 2 years ago | (#42060969)

I work for a company with 1200+ VMs and the change freeze concept is nothing new. For us, it's only 1 month around new years and mainly due to staffing issues if something goes wrong.

Go dedicated or go home (2, Insightful)

A bsd fool (2667567) | about 2 years ago | (#42060997)

Under any shared hosting, or control-panel-abstracted hosting, you're at the mercy of your provider for things like this. I realize they offer stuff on the cheap, but it's times like these when you realize you're getting what you've paid for. Many more hosting companies have hypervisors amongst their offerings than did just five years ago, and you can get a basic ESXi server for $50/month or thereabouts. Add memory, disk space, IPs, and bandwidth to suit.

Re:Go dedicated or go home (3, Informative)

GNUALMAFUERTE (697061) | about 2 years ago | (#42062691)

I'm using server4you. Their support sucks if you have to call them (they speak german, and very very limited english). If you need support, this is not your company. But if you can manage your own boxes, their uptime is great, and so is the hardware and bandwidth. In the last year we had less than an hour of downtime, and it was after midnight.

The interesting thing: The prices. $28 for an Athlon X2 with 4GB RAM, 2 SATA disks and unlimited bandwidth.

Again, the support desk is impossible mostly due to the lack of English proficiency, and their billing department suffers the same problem if you ever have an issue, but they do offer web reboots (you click a button, your servers gets rebooted usually in under 5 minutes). I once requested a server re-imaging and it was processed in 20 minutes. Hardware issues are taken care of very fast too. So, if you know what you are doing, and need nothing but hard-reboots and re-imaging if something goes horribly wrong, it doesn't get any cheaper than that.

Re:Go dedicated or go home (1)

Runaway1956 (1322357) | about 2 years ago | (#42064177)

Have you ever considered learning German? Then, you could butcher their language as readily as they butcher yours! it's always an advantage when you can insult the sheistikopf in his native language!

Better safe than sorry. (3, Insightful)

Anonymous Coward | about 2 years ago | (#42061005)

This is for automated patching, you may certainly request to be patched by the support teams. Typically these two months are the busiest for online shopping sites and a botched patch could cost the business tons of money. Since you know your business the best, you make the call. Better safe than sorry in my opinion.

Translation (2)

bersl2 (689221) | about 2 years ago | (#42061007)

Translation: "Dear Slashdot, I'm looking for a good Windows host. Any suggestions?"

Re:Translation (1)

Anonymous Coward | about 2 years ago | (#42061077)

I've heard on the interwebs about this student, I think his name is Linus who created some OS called 'Linux'. It's like BSD (1-800-ITS-UNIX) but free as in freedom and beer.

Unless you're running some stupid server which requires ASP.NET, in that case go dedicated.

Re:Translation (1)

History's Coming To (1059484) | about 2 years ago | (#42061491)

Out of curiosity, can you run a .NET framework on a linux server via WINE? Or can you legitimately use the Windows licence to run it virtually?

Re:Translation (0)

Anonymous Coward | about 2 years ago | (#42061975)

Thanks to the Mono project, ASP.NET (and C#.NET) applications can be served using Apache. I believe you need mod_mono. http://www.mono-project.com/ASP.NET

No Windows (or WINE) needed.

Yes, but ... (1)

dbIII (701233) | about 2 years ago | (#42062927)

Yes you can (or even better with mono), but your application may not like it, so it depends on what you are running. Some do run as well that way as on an MS system and I'm using it so users can get to a single licence application using dotnet (fucking stupid name you can't use in a sentence) remotely via X instead of hotseating. Yes I know a lot about VNC but it sucks in comparison on a decent local network for several reasons, and that linux box in the server room has far more memory and CPU power than any of the available MS Windows workstations.

Re:Translation (0)

Anonymous Coward | about 2 years ago | (#42061191)

The oxymoron contest is in the next room. HTH.

Exercise that redeployment plan (3)

RichMan (8097) | about 2 years ago | (#42061015)

As company using a hosted service you do have a redeployment plan should movement to another hosting service be required, don't you ?

Now would be a good time to exercise that plan.

This is what happens when you outsource (1, Interesting)

BitZtream (692029) | about 2 years ago | (#42061017)

While I think its rather unacceptable for this to be done, its not all that surprising and you kind of deserve the result.

When you outsource you sacrifice things. Why are you letting them patch for you anyway? Its not like they are going to do anything special. All the do is release patches from their own internal WSUS server (or whatever its called now) rather than you have to do it yourself or letting the machine auto-patch on its own.

Realistically, if you're going to have someone else auto-patch, you might as well just turn automatic updates on fully and be done with it. They only thing they are going to 'save' you from is if a patch happens to interfere with something locally on their network which is going to be pretty damn rare.

Re:This is what happens when you outsource (-1)

Anonymous Coward | about 2 years ago | (#42061093)

you kind of deserve the result.

Did you seriously just blame the victim?

She got what she had comin, dressed like that!

Re:This is what happens when you outsource (1)

MightyMartian (840721) | about 2 years ago | (#42061627)

He's a victim like a guy who had the choice between a $3000 used car with seatbelts and a $100 heap with a garbage bag for a passenger-side window, and picked the latter.

Re:This is what happens when you outsource (1)

dalias (1978986) | about 2 years ago | (#42062293)

No, apparently he picked the $10,000 heap with a garbage bag for a passenger-side window.

Re:This is what happens when you outsource (1)

Pentium100 (1240090) | about 2 years ago | (#42063877)

Do you use SSL to access your bank account?
Do you use strong passwords?
Do you use a firewall and patch whatever OS you are using regularly?

If so, why? Nobody will hack you, after all, hacking is illegal and nobody will blame you for having "password" as your password even if someone does hack your account (and steals your money) or hacks the company that you work for. It's all the fault of the hacker.

Locking your car and house is stupid too - stealing is wrong so nobody would steal even if you left the doors not only unlocked but open. And nobody would laugh at you even if you get your stuff stolen after leaving the door open.

I mean look at Sony - they used bad security practices and got hacked, but nobody blamed them, after all, the hacker should not have hacked even if the password was "12345".

Conclusion: using any security is stupid - it will make the system less convenient to use and nobody will hack you anyway (since it's wrong), so why bother?

Careful you don't hurt yourself (2, Insightful)

Sycraft-fu (314770) | about 2 years ago | (#42061243)

When you fall off that high horse.

What is the reason for an anti-outsourcing rant in this thread? To me, it sounds like the guy has his own website and that's what he's talking about. Do you host your own website? By that I mean do you have your own server, on your own property? If not, then you are outsourcing it. Even if you do, you are still probably outsourcing your Internet access and power generation.

If you don't like outsourcing that's fine and there's plenty of arguments against it, but save it for when it is relevant. Don't just go off on it.

Most individuals outsource their webhosting, and for good reason.

Re:Careful you don't hurt yourself (1)

Anonymous Coward | about 2 years ago | (#42061637)

I outsourced my datacenter's power to a "green" facility that promised only to use hamsters running on their merry wheels. Little did I know those little fuckers only live for 1-2 years on average.

Re:Careful you don't hurt yourself (2)

BitZtream (692029) | about 2 years ago | (#42062289)

Yes, I have a server sitting on my property. I have a government regulated Internet connection and power connection with HARD SLAs regarding availability. You want to try that one again?

That is entirely besides the point. There is nothing wrong with outsourcing. I also host certain parts of my infrastructure in someone elses data center. What I do not do is depend on someone else to do the job of Windows update when they provide absolutely no advantages of turning on auto-updates and the provide obvious downsides like the very one the submitter submitted.

I evaluate the benefits and risks of outsourcing and then decide where I'll get the better fit for my situation.

I walked into managing a cluster of servers with that outsourced patch crap, worst idea ever. They provide no advantage over just turning on auto-updates. They don't actually test it with 'your software'. They don't generally provide any better way to roll back a patch set other than 'use the system restore'. They do absolutely nothing that turning on auto-updates wouldn't do for you.

Its just another way to blame a problem on someone else rather than being responsible for it yourself. Its like buying support contracts for Linux. Its just an excuse. It doesn't actually solve the problem, it just shows you aren't capable of doing the job yourself.

In this case it shows the submitter didn't bother to even consider what the benefits of having the company do patch management for him were, which are none. That is why I can stay seated on my horse.

Top it off ... he couldn't bother to do some Googling for the answer. He isn't qualified for the job.

Re:Careful you don't hurt yourself (1)

marcosdumay (620877) | about 2 years ago | (#42062557)

You know, I outsource a server.

Yet, I choosed a provider that gave me the things I care about. I have a nice SLA to rely upon, and I don't outsource configuration, because that is just stupid.

Yet, there it is somebody outsourcing configuration, and complaining that the provider won't configure the machines exactly the way he wants. Duh. You can be sure that if they were configuring the machines the way he wants, somebody else would be here, complaining about it.

This is common, but.... (4, Interesting)

Anonymous Coward | about 2 years ago | (#42061021)

This ("change moratoriums") is a common practice around the holiday season. A number of the datacenters and other vendors I work with implement similar policies starting right before "black friday" and ending a week after new years. The logic is that changes could have undesirable consequences and the volume of e-commerce around this time would result in a potentially detrimental impact on operations. However, I have never heard of a company that holds out on security updates and other critical fixes due to such a moratorium.

Re:This is common, but.... (2)

sjames (1099) | about 2 years ago | (#42062087)

It's a tough call, but it's worth keeping in mind that not all windows updates go smoothly.

Managed services usually have contracts (0)

Anonymous Coward | about 2 years ago | (#42061039)

You could always stipulate this in your contract. I'm on the fence about this since you consciously made the decision to have managed equipment. It's not like they're a Colo... with the advantage these services provide, they're some downside revolving around control.

You could politely ask your lawyer to review the contract to look for liability should you get hacked while the change window is frozen.
( hint: it's your liability )

What does your contract say? (3, Insightful)

HaeMaker (221642) | about 2 years ago | (#42061061)

Two months is a looong time. 17% of the year not getting full fidelity on your contracted services seems excessive. Usually, changes freezes are a few hours in the middle of the night, once a week.

Re:What does your contract say? (1)

viperidaenz (2515578) | about 2 years ago | (#42061205)

a change window is usually a few hours in the middle of the night. A change freeze is usually the length of a holiday period or other such period of either reduced support staff and/or high risk. eg: christmas = high sales time, so high cost of outage and reduced staff due to holidays.

Re:What does your contract say? (1)

HaeMaker (221642) | about 2 years ago | (#42061493)

Oops, yea, you are right, but there are usually provisions for security related changes or emergency changes, and two months is still too long. Week before and after black friday, then two weeks leading up to Christmas should be plenty.

Re:What does your contract say? (0)

Anonymous Coward | about 2 years ago | (#42064327)

Emergency change controls are exempt from change freezes and are up to the service providers' discretion.
A managed patching service that implements a two month change freeze means one thing, they use a cloned base-VM image with all patches installed there, and as such you simply can't patch your VM without all VMs being patched.

This is a bad model and you should ask for your VM to be cloned to a non-linked image environment where you can have your own patches installed.

Omg (-1)

Anonymous Coward | about 2 years ago | (#42061075)

Dude,

Buy a supermarket pc and put openbsd on it.

Dude (-1)

Anonymous Coward | about 2 years ago | (#42061101)

Buy a supermarket pc and put openBSD on it.

POS (0)

Anonymous Coward | about 2 years ago | (#42061125)

They're probably also hosting someone in the POS business and, historically, despite oodles of testing, applying patches during critical sales periods results in outages that lose a lot of moola... the freeze periods get born and propagated across all customers they host via management... just the way the cookie often crumbles...

You're with a managed services provider? Consider yourself duly managed.

Re:POS (4, Funny)

viperidaenz (2515578) | about 2 years ago | (#42061241)

Are you referring to Point of Sale business or Piece of Shit business?

Re:POS (4, Funny)

Dewin (989206) | about 2 years ago | (#42061705)

In my experience, they are one and the same.

Change freezes? (1)

Anonymous Coward | about 2 years ago | (#42061199)

Is this something to do with global warming?

Hardly baffling (2)

Gothmolly (148874) | about 2 years ago | (#42061207)

Real (TM) IT shops have change freezes all the time. It's called release management. Perhaps you should a) host on some more stable platform, or b) co-lo your own gear where you can run daily patches and reboots and only affect your own stuff.

Re:Hardly baffling (3, Informative)

nabsltd (1313397) | about 2 years ago | (#42061403)

Perhaps you should co-lo your own gear where you can run daily patches and reboots and only affect your own stuff.

Unless the OP is sharing an actual Windows instance with other clients (which would mean he should be paying about $1/month in fees), rebooting his instance should only affect him.

It's possible that he is paying for a Windows instance on top of Hyper-V, and the underlying OS isn't getting patched, but that really shouldn't be much of a security risk for the OP, as the hypervisor OS isn't visible to the outside world. Likewise, even if he is sharing access to back-end services like SQL server, it's unlikely that the API he is using to connect to those services is vulnerable in such a way that a patched client would be a problem for an unpatched server. It's far more likely that there are SQL injection or other issues on the clients than a non-administrator connection to an unpatched server causing a compromise.

Re:Hardly baffling (1)

MightyMartian (840721) | about 2 years ago | (#42061657)

I certainly put freezes in place for a week or two surrounding major holidays like Christmas. But we're talking about a damned long freeze here.

Re:Hardly baffling (2)

AK Marc (707885) | about 2 years ago | (#42061939)

Everywhere I've seen a "change freeze" stated, "critical" changes/updates are allowed, just with "critical" being variable.

Not if they want to keep customers (0)

Anonymous Coward | about 2 years ago | (#42061237)

I'd vote with my virtual feet. Of course, I wouldn't serve from Microsoft software anyway. I'm not a MS basher. I love it on the desktop. I just wouldn't use it as a server. It wasn't designed as one from the ground-up, the culture surrounding it is not as proficient. It shows.

"Your" servers? (2, Insightful)

Anonymous Coward | about 2 years ago | (#42061269)

How are they "your" servers if you cannot patch them whenever you deem necessary?

Standard practice (4, Informative)

Jethro (14165) | about 2 years ago | (#42061295)

Having change freezes is standard practice. Most places I've worked have a short month-end freeze, and a couple of month year-end freeze.

However, critical security vulnerabilities are exempt from these freezes. Those still get done using whatever emergency protocols are in place.

Re:Standard practice (0)

Anonymous Coward | about 2 years ago | (#42061709)

I work in finance, and I can attest this is normal. In addition to holidays, we also have freezes at month end and "Operations Expiration" weekends, which typically occur on the 3rd weekend of the month. While it's not an absolute freeze, you'd better be willing to be your job on the change you need to make during those weekends.

Re:Standard practice (1)

Crypto Gnome (651401) | about 2 years ago | (#42064529)

Having change freezes is standard practice. Most places I've worked have a short month-end freeze, and a couple of month year-end freeze.

However, critical security vulnerabilities are exempt from these freezes. Those still get done using whatever emergency protocols are in place.

Especially for systems hosted in The Northern Hemisphere.

It's winter, people should know enough to expect freezing this time of year.

Is this common practice for change freezes in Dec. (1)

shuz (706678) | about 2 years ago | (#42061383)

Yes! If your company does not have a change freeze in effect for at least some portion of December or November it should. Nearly all countries and religions observe significant national holidays during this time. It also tends to be a very significant or the most significant time of the year economically for many countries and companies. That said non-functional security patching and security related activities would be good exceptions to this rule. Large hosting providers, not wanting to single out customers, often have blanket change freezes in effect including patching.

rackspace (2, Informative)

Anonymous Coward | about 2 years ago | (#42061445)

If you read the email properly, they are not doing automatic patching of these releases, but nothing to stop you applying them yourself.. or getting them to apply them if you specifically ask for them.

Change Hosts (1)

pubwvj (1045960) | about 2 years ago | (#42061477)

Time to change hosts.

Not hosting (3, Insightful)

LordLucless (582312) | about 2 years ago | (#42061543)

You didn't get this email from your hosting company. You got it from the company managing your servers. The fact that it's the same company is largely irrelevant.

If the server management company isn't flexible enough to meet your needs, do it yourself. You keep track of the patches, you decide when they're ready for release, you release them, you test them. If you don't have the skills for that, or the money to hire someone with the skills, then get another company to do it. If you're using a dedicated server, there's nothing stopping you giving someone else the access to manage and patch it.

If you yourself don't have root/Administrator access, then you don't have a server; you have access to a server. Fork out a little bit extra, and get a dedicated box that you control.

Re:Not hosting (0)

Anonymous Coward | about 2 years ago | (#42061783)

Three letters...

VPS

It's dirt cheap now, you control the full OS level, just trust the hosting company with the hardware and hypervisor... much lower risk. No reason anymore to just do web hosting, get the rest of the machine.

A retail customer probably uses their service (0)

Anonymous Coward | about 2 years ago | (#42061823)

It is standard practice for a lot of retailers (Big Box and E-tailers) to institute this type of freeze. If the host also offer co-location services, there are a couple big e-retailers, that require these types of holds for anything and everything in the building during the holiday season. They are fierce about it to, one time a co-lo provider was making changes to a door in the DC, the customer freaked out, and tried to fine (per the contract) the co-lo provider. A lot of providers cave and don't do anything for nov-dec.

Words vs Actions (3, Informative)

holophrastic (221104) | about 2 years ago | (#42061889)

You can't put up a sign that says "only a few people allowed beyond this point". And you can't put up a sign that says "very little loitering accepted". So you put up signs that read "no access beyond this point" and "no loitering", and then you simply don't enforce it for the first few people.

If this company has a reduced staff, or wants to ensure that large problems don't happen during sensitive times, then they might want the freeze. And saying that there will be a freeze is the way to do that. But calling them and saying "hey, I know there's a freeze, but I'd really appreciate this patch when it's convenient." won't likely be met with a solid "no, screw you, we're in a freeze".

Ice is usually still a little wet. Not every molecule freezes at the same instant.

Look at it as an opportunity for you to be nice. They said "we'd really like to ease the harsh environment of christmas IT", and you can optionally say "I'll help you out by not patching for a while". It's an opt-out instead of an opt-in scenario, but it's the same.

You're complaining about the default, not the final. And you can override the default with a phone call. Don't sweat it.

Utility companies (1)

Macgrrl (762836) | about 2 years ago | (#42062013)

I spent 2 years working for a utility company in Australia where we had an annual change freeze to core systems during the bushfire season. We couldn't afford for systems to be down for non-essential changes when there was the possibility of a 'real world' emergency breaking out. This went doubly so for anything involved in the SCADA network.

Troll (2)

vawarayer (1035638) | about 2 years ago | (#42062367)

If so, may I ask Eastern-EU folks to please refrain from hacking my servers

If so, may I ask the Slashdot editors to please refrain from letting people post trolls.

we have a year end freeze too (1)

milkmage (795746) | about 2 years ago | (#42062793)

we lock down from about mid december to mid jan.. partially because of staffing, but mostly because our enviornment needs to be stable for year end processing (I work for a bank). no elective changes are allowed during this time.. only fixes if something breaks.

we don't run our shit in thrid party datacenters, so it's not exactly the same scenario, but it's understandable that no changes are allowed. what if your stuff breaks and you don't have staff due to the holidays? if we fuck up, we only fuck up our shit... if a hosting outfit fucks up, they fuck up a lot of other people's shit..

maybe they host a lot of retail outfits who need to be up for the holiday shopping season.

Yahoo! Small Business has freezes. (0)

Anonymous Coward | about 2 years ago | (#42063171)

I used to work for YSB and they have patching freezes around this time of year on their e-commerce platform. They want to make sure everything is as stable as possible for the influx of business.

Article is based on incorrect reading (3, Informative)

phoebusQ (539940) | about 2 years ago | (#42063185)

I know which host and to which announcement this refers. All this is is a suspension of fully automated patching during the holiday season. If you want patching performed anyway, jut contact your support team. They prefer to make patching opt-in during this period to avoid site outages due to patching miscommunications.

Customer satisfaction is important to us. (3, Funny)

Mr2cents (323101) | about 2 years ago | (#42063513)

may I ask Eastern-EU folks to please refrain from hacking my servers during the holiday season?

Sure, just provide me with your domain name, provider and root password and I'll add you to my do-not-hack list.

do it your goddamn self (0)

Anonymous Coward | about 2 years ago | (#42063855)

if you dont like the service from the minimum wage gardeners you hired, get someone else

or just weed your own fucking flower beds

dont whinge about it here

Why still allow top hacking countries? (2)

Moskit (32486) | about 2 years ago | (#42064495)

I'm sorry to say that OP seems to be nationalistic about his "hacker countries" conception, promoting negative stereotypes, not to mention that he confused EU with Europe.

Top hacking countries are very different from Eastern Europe countries: USA (yup, still number 1 spot), China (Eastern, but not European), Russia (not Europe, just Eastern), Brazil, Germany (Europe and EU, but not Eastern), UK (an island off Europe coast), India (totally away from Europe)...

With your attempt at "humour" you basically allowed all those people right to hack your servers over the next two months ;-)

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>