Hacker News Reader

Comment by sagischwarz | Hacker News Reader

That's right. But updating everything except the kernel also seems strange.

Well, on Linux distros it is not uncommon for individual packages to be updates as updates become available. So if there is an update to, say, the web server, it is sufficient to restart the web server.

On BSD systems, kernel and userland are developed in lock step, so it's usually a good idea to reboot to be sure they are in sync.

Usually you'd be running the same userland daemons on FreeBSD that you might on Linux. Web servers, databases, OpenSSHd, file networking protocols (FTP, SMB, NFS, etc), and so on aren't generally tied to a particular kernel version since ABIs are not subject to frequent changes (it would be very bad if they were).

So with that in mind, you can update your userland on FreeBSD without updating your kernel in much the same way as you can do with Linux. Though it is recommended that you update the entire stack on either platform.

Updating the FreeBSD base (to the next major release) without updating the kernel is Not a Good Idea. Backward compatibility is there, down to version 4.x, but no one guarantees forward compatibility!

Applications will usually work, but the base system will likely break in some places.

Yes, but 'freebsd-update' is akin to an 'apt-get dist-upgrade'. Regular updates from 'pkg' or ports should be fine.

It's not at all strange. Security updates to publicly-facing services should be applied as fast as possible. Kernel vulnerabilities are a whole different attack surface

Kernel vulnerabilities can be combined with user space vulnerabilities. eg a buggy web script might allow an attacker shell access under a restricted UID. The attacker could then use a kernel vulnerability to elevate their permissions to root.

Reply on news.ycombinator.com