Ask Slashdot: Should Hosting Companies Have Change Freezes? 138
AngryDad writes "Today I received a baffling email from my hosting provider that said, 'We have a company-wide patching freeze and we will not be releasing patches to our customers who utilize the patching portal for the months of November and December.' This means that myself and all other customers of theirs who run Windows servers will have to live with several critical holes for at least two months. Is this common practice with mid-tier hosting providers? If so, may I ask Eastern-EU folks to please refrain from hacking my servers during the holiday season?"
change freeze (Score:5, Informative)
I work for a company with 1200+ VMs and the change freeze concept is nothing new. For us, it's only 1 month around new years and mainly due to staffing issues if something goes wrong.
Standard practice (Score:5, Informative)
Having change freezes is standard practice. Most places I've worked have a short month-end freeze, and a couple of month year-end freeze.
However, critical security vulnerabilities are exempt from these freezes. Those still get done using whatever emergency protocols are in place.
Re:Hardly baffling (Score:4, Informative)
Perhaps you should co-lo your own gear where you can run daily patches and reboots and only affect your own stuff.
Unless the OP is sharing an actual Windows instance with other clients (which would mean he should be paying about $1/month in fees), rebooting his instance should only affect him.
It's possible that he is paying for a Windows instance on top of Hyper-V, and the underlying OS isn't getting patched, but that really shouldn't be much of a security risk for the OP, as the hypervisor OS isn't visible to the outside world. Likewise, even if he is sharing access to back-end services like SQL server, it's unlikely that the API he is using to connect to those services is vulnerable in such a way that a patched client would be a problem for an unpatched server. It's far more likely that there are SQL injection or other issues on the clients than a non-administrator connection to an unpatched server causing a compromise.
rackspace (Score:2, Informative)
If you read the email properly, they are not doing automatic patching of these releases, but nothing to stop you applying them yourself.. or getting them to apply them if you specifically ask for them.
Re:windows? what were you thinking? (Score:5, Informative)
No effing way. Only a complete and total newbie would even contemplate that, and I'd fire the first admin who tried to put such a thing in place.
Exchange as an MTA sits behind firewalls and a spam filter (be it home-brewed atop a Linux machine, or an automated commercial appliance, e.g. Barracuda). OWA you put in its own DMZ, insulated on all ends by industrial-grade firewall/security devices. Even Microsoft anticipated that one, and allows you to rig it exactly like that (with the MTA and all other bits buried in your internal network).
Back to TFA, I'm curious as to what's stopping the article submitter from sticking in a simple SCCM** box (or at least script something in Powershell that ties into Windows Update) and do his own %}$#@! patching? Relying on anyone other than the OEM to do patches is kinda, well, dumb.
.
** I know, I know - SCCM blows goats. But it's not like it's completely impossible to set up, and besides - that's the price you pay for using so much Windows gear.
Words vs Actions (Score:4, Informative)
You can't put up a sign that says "only a few people allowed beyond this point". And you can't put up a sign that says "very little loitering accepted". So you put up signs that read "no access beyond this point" and "no loitering", and then you simply don't enforce it for the first few people.
If this company has a reduced staff, or wants to ensure that large problems don't happen during sensitive times, then they might want the freeze. And saying that there will be a freeze is the way to do that. But calling them and saying "hey, I know there's a freeze, but I'd really appreciate this patch when it's convenient." won't likely be met with a solid "no, screw you, we're in a freeze".
Ice is usually still a little wet. Not every molecule freezes at the same instant.
Look at it as an opportunity for you to be nice. They said "we'd really like to ease the harsh environment of christmas IT", and you can optionally say "I'll help you out by not patching for a while". It's an opt-out instead of an opt-in scenario, but it's the same.
You're complaining about the default, not the final. And you can override the default with a phone call. Don't sweat it.
Re:Go dedicated or go home (Score:3, Informative)
I'm using server4you. Their support sucks if you have to call them (they speak german, and very very limited english). If you need support, this is not your company. But if you can manage your own boxes, their uptime is great, and so is the hardware and bandwidth. In the last year we had less than an hour of downtime, and it was after midnight.
The interesting thing: The prices. $28 for an Athlon X2 with 4GB RAM, 2 SATA disks and unlimited bandwidth.
Again, the support desk is impossible mostly due to the lack of English proficiency, and their billing department suffers the same problem if you ever have an issue, but they do offer web reboots (you click a button, your servers gets rebooted usually in under 5 minutes). I once requested a server re-imaging and it was processed in 20 minutes. Hardware issues are taken care of very fast too. So, if you know what you are doing, and need nothing but hard-reboots and re-imaging if something goes horribly wrong, it doesn't get any cheaper than that.
Article is based on incorrect reading (Score:4, Informative)