2.5 Admins 222: Surprise Upgrade
30:22 Share

To the half had been episode to to, to.

I'm to, i'm jim and I am Allen .

and he were again, before we get started, you ve got one, your plugs. And D, K, M, S. Versus came out out. The essential guide for that s on linux.

yeah, as we continued to support that of s on every platform that people use IT on, the biggest thing we run into, people running that of us some minute s in having problems every time they update the kernel. And so we talk about the prosing kinds of the two different main ways of doing that. The first being D, K, S, where the builds a small automatic rebuild. Z, F, S, to match the kernel every time that updates, or A K, mod, where car provides as a service the ability to have a package that in a repo that will be a came out built of that of s that matches your kernel and how you can do that yourself as well.

right? Well, looking to show as usual, let's do some news then. Windows seven, twenty twenty five takes admins by surprise, just randomly upgrading a major version overnight.

No big deal. You IT was bad enough when windows seven machines were just like spontaneously attempting to upgrade the windows ten overnight, whether you told them not to or not. But this one caught me by surprise.

I say, come to my surprise, talking about the news. To be clear, I haven't seen IT in person yet, thank god. But how horrifying .

very you. These servers running them, it's usually doing something specific and you don't want to just revoting that often anyway, right? Like you want to control the updates but then to just come in and find that it's not even the same version that O S anymore.

You be like who touched this? I'm going to beat them senseless. But IT sounds like a mistake made IT think that the O S upgrade was one of the security updates and apply to the machine anyway, without ever asking anybody.

I have a lot of trouble finding the words on this one because it's just it's horrifically sloppy is what that is. I know i'm started ted to sound like every old man everywhere who said things were Better when he was Younger. But corporations the size of microsoft just did not use to be this sloppy with Q A.

On shipping products. There used to be the sense of like, oh, you know, we have a certain standing we need to maintain and we need to measure twice and cut once. And IT feels like all it's just gone out the window and good enough for close to good enough is, well, that little pig luu.

yeah. I think part of that might be the fact that windows server is in their flight ship product that they make all their money off anymore. It's all there is zero cloud stuff and so they maybe don't treat at the same. Although if you go back to the early days of a windows service stuff, like if you were going to upgrade from this version, that version IT came on A C D in the mail and you had to go around to each machine and plug IT in and do IT you aren't just, uh, automatically installing updates from the internet and then being surprised when you have a different version of the west tomorrow.

While microsoft did publish issue details, windows servers twenty twenty two and server twenty twenty unexpectedly upgraded to windows over twenty twenty five. And in this issue, they say some devices upgraded automatically. This was observed in environments that use third party products to manage the update of kinds and service. So they basically blaming on someone else.

right? Although one of those companies called home says that microsoft mistakenly labelled the server two thousand five upgrade as being K B 5o four four two eight four， which is a security update. And so something that left over in the build system is something, and the update got take the same as the security update.

And so their software decided to install IT. I think the other thing that I would say is compared to in the year old days, I had upgraded from server thousand and nine to twenty twenty five, and IT worked on the first try, and IT revoted, they came up and I was right. Maybe the suffer has got to look Better.

That kind of blue. My mind. Also, I was not aware that there even was a modern in place of great option for the server side of the O S.

The consumer side, it's been working pretty well since the seven to ten. But on on the server side, i'm not sure when that became an option. I i've always needed to, whether I wanted to or not, do know. Complete reload and manually migrate workloads from one box to another.

A usually IT was always A A good time to get a fresh in style anyway, because I was always gonna Better as a fresh and stalled .

back to the point of a microsoft ms. Labelling IT as a security up data, a feature update instead of a major opening system version at grade. That all seems like a very facile excuse to me.

And IT feels like we're ignoring the core point, which is the there ought to be more separation between a major O S version upgrade and either a feature or security update in the first place. Like that feels like hopes I X notionally mistook the lamborghini for the baby stroller. Like how do how did you do that? Like those are not the same thing.

Don't they don't look like each other? Just know if when the server was a rolling release distribution like some of the linux where it's like, no, we've evolved beyond version up grades and the host to s is always expected to work with an acceptable grammar. And you know we don't expect applications to seize working with an acceptable for members either.

And that's just what the ecosystem does. That's one thing. But that's not the expectation anybody has windows, the expectation everybody has windows. And as a well earned expectation is that even if everything goes perfectly, when you do a major version upgrade from one of the next, it's entirely possible that severe applications will refuse to work properly on the new version and that will need to be sorted .

out or maybe that even the software works. Your support contract with provider, you know, says we only support these things like we've not tested IT with server twenty five enough yet. So you get no support.

If you're running on twenty five five, you're on your own. And while microsoft pulled the update to stop from happening to more people, there's no sign that they're gona offer some kind of roll back. And you know I don't think you'd want to try to roll back from server twenty five five back to twenty nineteen. That's, well, the upgrade process maybe as gotten Better. I det, the roll .

back as Z F S roll backlash are .

the only way to make IT actually happened.

Well, one of the register articles that will linked to brought up the issue of licensing as well. They quote the chairman of this handle company who says the licensing check for over twenty and twenty five happens only after the upgrade, which is completely irrational and adds further risk for end users.

But I can see him running into troubles. If you get upgraded, not by choice, and then get told that, uh, your license doesn't work for this version.

There is also the fact that when the server twenty twenty five currently has issues running on hardware with massive numbers of process logical processors, two and fifty six or higher have been known to exhibit serious problems on what is twenty twenty five that weren't at present in earlier versions. So I mean, there's a lot of potential for chaos there. And I think at this point, there's probably not a whole lot of reason going innumerate all the different ways that, that can make your life. So because we could be here all day talking about all the many ways that I could absolutely suck to suddenly find out that your servers have just magically changed to a different Operating system version than they were when you get got up that morning.

Yeah, this specially a nightmare field for most statements.

Before we move on from this, we probably have to talk about the winters of great slapping, ss, bleeding down the consumers, that of things as well. A lot of consumers were surprised in the upset when they discovered their wind is eleven, warning them that when is eleven twenty three h two was ending support and exporting them to upgrade.

The problem with that is when is live in twenty three two isn't actually scheduled to in support until next november, not this november. And eleven twenty three two is actually the current correct version that you should be running that upgrade notice, which is false, closely follows the legitimate of great morning. The users of twenty two h two were given earlier this month. So it's just a complete sloppy chocolate mass over in microsoft land right now.

Something that was announced ignored recently was windows three sixty five link, what they're calling the first cloud PC device for windows three six five and .

what will be calling jose favorite new lights s local machine about five years.

Well, maybe except that it's got a lot of secure boat stuff that I don't think you can turn off, unlike with the wise fifty, seventy thin clients that made in the linux after dark, guys like to mess with.

Yeah, the original likes box was unhackneyed that work out well indeed.

yes. So i've used windows three sixty five for a customer, and basically they give me A A virtual machine inside their network. And I use windows three sixty five to connect that.

And IT does the whole two factor authority, everything. But this thing basically will replace the P. C. On your desk at the office with this little box that basically does nothing other than connect to windows three sixty five, where your actual machine is A V M running in a data center somewhere, I can see the appeal. But at same time, it's subject to all the latency of your wifi and your network and your internet connection. And so i'm not a huge fan of moving my entire computer into the cloud.

I'm not a huge fan of moving my entire computer in the cloud because I don't trust the cloud. The manager for me, I mean, microsoft has absolutely should, can and x box live account of mind before and claimed that IT never existed afterward, which tells me that I really don't want to just give microsoft, like all all, love my data in programs and infrastructure, everything. And just imagine that will be okay as some random consumer.

right? This is more targeted the corporate environment and especially where IT would be hosted. So maybe not even the cloud, but this is running, you know at your company's data center. But even then, we really assume we all always have an internet connection, but that's really not true.

Yeah, we assume no such thing. A lot of the industry likes to assume that. Alan, I do not I suspect you doesn't either. We are big fans of having control of your infrastructure. And still being able to do things when the link to the great big world network goes down as we expect to do now and again.

But you can see the appeal for something like this for IT managers at least being able to say, yeah, let's not worry about in point security. Essentially.

if you mean career IT managers of the sort where the manager is capitalized in the IT is, you know, a type face about three point size is smaller. Yes, I absolutely see the appeal. On the other hand, if you are an I T manager who eventually wound up any management position because you did a lot of work in the trenches and you actually know you're bt from home ground, no, I I don't really think it's all that appealing at all.

There are a huge number of downsides to this, and it's another of those. Nothing is ever truly new on to the sun. You know, we keep going through these cycles.

I was preaching the people about these cycles where we go in between distributed and localize computing all the way back in the early nineties. And we're still doing IT. And every time the cycle tips from one side of the other, everybody always acts like centralized computing.

Is this brand new idea and nobodies ever explored before? Well folks, in one hundred and ninety one, I was Operating a honeywell. Three b.

two. No, sorry, eight and t three b two computers. And I forget the of the honeywell mini computers in various different navels installations, most of which had been there since the eighties. Centralized computing with distributed clients is not knew that he has its downsides. There are always well up.

but the internet much faster now speaking.

the internet being much faster now. When I was in high school and I worked the power plant, they had a thing where you dialed in with a mode and to connect to cricks, to control a machine at the plane from home or from the road. And that was, you know, remote.

This up would just term term slow about red to what we have now. But I can see some of the advantages of if everybody's desktop is just A V M, that I can run IT all of set of us and step shot them all and not have to review people's machines being to roll them back if they screw them up. But it's a lot to trade off for that. And if you're getting down to that point, what do you need the thin client .

for just to make absolutely sure nobody doesn't work anywhere but your precious cloud?

exactly. You're eliminating a lot of variable.

And I mean, that is a lot of the time what centralized computing with distributed clients is genuinely about. I mean, sometimes it's about again, you know back in the eighties, when you are looking at centralized, you have many computer remain frame set up very frequently.

You couldn't afford to distribute that amount of computing to that many different workstations made since to have one single massively powerful of the time machine with a bunch of thin client that accessed. But more than that, usually the shift toward centralized computing, it's about control. It's about making sure things happen the way that the centralized entity wants to enforce them happening. And that's one thing when like you're a company and you're the one doing the enforcing of your own policies. It's another entirely when you're an individual or a smaller company who is at the mercy of a corporate giant who is setting the policies in dictating everything and you just get like a .

allum IT yeah yes. In my use case, the whole point of using windows three sixty five is that virtual test top is the thing that trusted to let me access the sensitive of data, and I can access IT from whatever machine I happen to have, rather than needing a dedicated special piece of hardware that's been to me.

IT is a compliance manager dream and a sister men's nightmare because it's going to be all sorts of problems with people in shade, wifi and all the rest of bit. But if your job is as a suit who likes to tick box is, you can see how microsoft can sell to them all these buz words about enhancing security, increasing efficiency, sustainability, IT seems like such an easy sell to me, to the people who don't really know, as you say him, what it's like to have boats on the ground.

The thing that always happens, that sort of thing is it's very easy to sell all sorts of really dumb things to people whose prime occupation is manager. You know, the ones where manager comes first and anything else is just kind of a niche that's tacked on later. But the primary thing is manager.

You can sell things to managers on the basis of easy management while ignoring physical reality pretty easily for quite some time until you've sold so much. Dodging on sense, that doesn't make sense, that everything just flat stops working, and then you have a catastrophe and you get to recover from that catastrophe. And there is a whole bunch of sterman asks that could have been avoided if you just kept a title grasp on reality as opposed to management fantasy in the first place.

okay? This episode is sponsored by people who support us with paypal and patron. Go to two dot five aben stock comet slash support for details of how you can support us to patroon supporters have the option to listen to episodes without us like this.

And it's not just this show. There's late nights linux for news discoveries, audience input in masanath ropy. Linux matters for a big family friendly adventures, linux after dark for silly chAllenges and philosophical debates.

Linux test time about developing with and for linux hybrid cloud show for everything public and private cloud. Ask the host for off topic questions from you. You can even get some episodes a bit early.

So if you like what we do and could afford IT IT would be great if you could support us two at two dot five admin stock com slash support. This is some free consulting then the first just quick thank you to everyone who puts us with paper and patron. We're really appreciate that.

And if you want to send any questions for german or your feedback, you can email, show a two five admin tocom. Another perk of being a patron is he gets skipped the q, which is what four has done now, thought rote to ask about security, backing up a friends at a fast, and voice versa. But we did cover that in epo de two one eight.

So do check that out though. And this mostly walls down to use the F. S.

Delegation to sort out your permissions. And the egypt, if you were about privacy. But four did add a new wrinkle. Can we use the force command option in S S H D configured to tighten things down even further?

Now, for those of who aren't familiar with force command, this is an option you can sit in the S H D config g vile that controls how your S S H server Operates, so that you can say, if user flu is to S H in, well, flu is only allowed to use this short list of commands, and food tries use, any other commands will just throw air and say, no, you can do that.

Or you can also set IT to just automatically run a single command of the instant user logs in no matter what they do. In theory, you might fh about with this to try to look for the additional security. But honestly, I don't think it's a good effort.

You can already limit what the user is able to do on one exists m well enough with simple permissions and with the ability use IT if this permission delegation to allow an otherwise completely unprivileged user that can even see outside of their own home to manage what they need to do on the Z F, S. Side of things. I think trying to fh about what force command is just going to be an exercise in making your system more fragile without making IT particularly more secure.

Yeah, you can lock down what they are able to do well enough that you probably don't need to do IT. Although when they brought up the first command thing and they thought that they would need, because they need to be able to do that F S list and that F S. Receive instead of us send.

And those are three separate commands that they wouldn't be able to do that must they created a bunch of separate users and had the different force command for each. And i'm like why, having in no way around that part. So the way as stage works with the authorized keys file, you can specify a command similar to the first command S S D config, but you can specify a command per s key.

So you can actually have three different S S keys, each one only able to do a certain event. So then you're client, you'd have to teach you to S S with this key and IT runs that if as list and then S S with this key and IT runs that you've have received. But you know you'd end up having a hard code, the whole set of rescue.

So you'd d also need the name of the data set to be part of the command. So you need a different key for every data set, for every receive. And I quickly get out of hand. And like jim said, you don't have to be given this block down user, any studio or anything. You can just use that F, S, delegation to allow that user run those specific Z, F, S commands, and nothing else.

I think that if he really wanted to chase some kind of like super secret squirl extra secure configuration, probably the the way to look at doing IT would be potentially having the remote side run in a container that had the cfs pull passed through into the container so that you could limit the non Z F S side of things even beyond the permission side by having that user trapped the sandbox container that only had access to fs. That would make a little bit more difficult that Z, F, S replication only user to do anything on the host system. I don't really see even that is worthwhile, but I think IT makes a lot more sense than the other approach.

yes. So dubia article coming out on cleared website in a couple of weeks on how to use the feature we built where you can delete just one dataset and all of its children to and d container, for example, in your bunt u and so with that, yes, you would basically have IT so that they have access to a container, not your whole system. And inside that container they can see the one day is set from your pool that you given them and nothing else. And then that would stop them from being able to see the rest of your home machine, because during their own complete names face different processes, different user names, I think, so they could never see any of the other files or other part of the pool in your system. And that way they be able to do all the servers commands they need, but only to the one data set they have access to.

Is this my inexperience showing here, or is a much similar solution, put a small separate box in each other's houses with just the data sets that you want on, say, just a two disk mirror? Just keep IT completely simple unseparated.

Yeah sure if you can afford uh, when I say a ford, whether we're talking about you know the cost of the hardware or just the space to hoster to the power or whatever, but sure if you can afford a separate physical box that makes all the things in the world absolutely have a backup box like just for that purpose. That's great. But I think that an awful lot of people are not necessarily going to want to not only have their own main computer and their own back up computer, but also their own back up computer is just for their friend and their friend. Really the same thing for them like that sounds a little harder to convince a lot of people to do.

Yeah like who's responsible for upgrading the O S. On this machine that doesn't get used for anything except your backups?

How long will IT take you to get your friend a bother to turn IT back .

on after power outage? Well, if you've got A V, P, N directly into that machine from your network, which will be down every time you have to upgrade IT, yeah.

try again. How long will you take to get your friend to address the issue when there's a power outage and it's off or when somebody didn't know what IT was an unplug bit moved IT or or or or IT? Please trust somebody who deals with machines that are hosted in people's homes. IT can be very difficult to give them to give a if the thing is in their home isn't actually mission critical what they do in their own home, even if it's a mission critical to them at work, it's real hard to convince a sea level who's got like a back up server hosted in their own home to bother turning the damn thing back on. After power age, IT will sometimes require weeks and that's when it's their own data that you're not backing up.

Yeah but there is a quit pro co here like if my friend isn't dealing with put in the power back on or whatever, then I might accidentally pulled the network cable out of his until he noses and then maybe we will both deal with that at the same time.

sure. But if it's on the machine that users every day he's going to make get turned back on, propose that the argument for going through the hassle of what was just talked about, right, and also using a bunch of face, they already have. He was playing with sh mutio, but IT was just not going to be used with each of you have to buy two more, more hard drives.

Is that much more fast? So we definitely see the appeal. But either you trust your friend a certain degree or you don't. And if you don't, maybe you want your own hardware, maybe you want IT in a data set or not other .

things I think doing in the gee way makes more sense for talking about really relatively light weight back up goals like you don't have a lot of space or you know a whole lot of whatever going on. IT might start looking attracted to Lucy.

No, i'm just gonna hit amazon and i'm going to get like one hundred and fifty dollar eight year old dell small form factor machine, and i'm not even going to put in a new hard drives and it's not going to have one drive. But you know what, it'll still be a backup target. I'm just going to install my Operating system on IT and sit up z fs on IT and say, hey, friend, do can you plug this in at your house and and done I think that makes a lot of sense.

I think that you know roughly like two hundred dollars Price tag with very little extra faffing around will probably sound pretty appealing. A lot of folks. I'm bd to do something fairly similar from my own parents who are in a retirement community, but half mile or so.

And my mom SHE really needs to have her laptop automatically backed up. And at first I thought that I could just do IT to my house. The problem is that, know, you never know when her laptop is actually going to be turned on, or for how long, or know how greater the wifi I is going to be.

They really need local backup solution. So they asked me to provide one. And that's exactly what i'm about to do.

I'm onna drop, a little dell small form factor that I picked up for one hundred and fifty box a couple of years ago. Absolutely hardware unchanged. I'm just gonna drop IT over there in the apartment and, you know, set IT up as automatic. Was that this pull .

back observer, Christian, whose patron also skipped the queue? He writes, is the quality of service a big consideration for you when you buy new machines? Where do you look for reviews and how do you rate the service? Is the time needed to actually speak to a person a big factor? Also, what do you consider acceptable to get a computer repair, including shipping? Can two to three weeks my current experience be considered? okay?

The answer is here. I don't generally look really hard to that because I am already firmly planning not to use any manufacturer warranties for repair of the machine I care about in the first place.

If i'm going to use an OEM warn on computer equipment at all, i'm going to be using IT in the sense that like i've already dealt with the actual Operational problem by either repairing or replacing the equivalent question and if IT was by a replacement, so now i'm left with the non functional box, which has has been replaced with a new box. Well, now I ve ve ve got to only more and to available. Sure, I might ship back off and say, pay, fix this.

And when he gets back to me, i've got a refurbish unit that I can sell or use for something different. So in that case, two to three weeks is about on par with what I typically see you unless you've got something with like yeah like a next day on sight policy like you'll get you know sometimes out of the deals or hp of the world, even on the fairly inexpensive machines that are targeted to corporate environments. But either way, it's it's really not a big selling factor to me.

I already addressed this with with Christian offline, and I advised human and advised everyone if you don't already have a good working relationship with a local PC repair place, if you don't do your own repairs, I strongly advise you to start looking around, you know, get around town, like go into a few shops, talk to some folks like see what kind of vibes you get, what the Prices look like. You really want to have that local support available. And it's not so much about whether IT was included in the custom machine is just about like can you get through your day or you stuck in this nights that is describing we're like you don't have a computer and you just have to shift the whole thing off and you're are hoping get IT back three weeks later yeah if you are the .

every place that needs. You know this machine is so critical that we're going to pay dell all this section money to make sure they are going to have someone here to look at within four hours. If it's that critical, you should just have a spare machine that can take over and write.

All your backup PS are set up so you can just the switch and the running off to back up machine in the meantime. And then IT doesn't matter. IT takes four hours or four weeks to get the the replacement hardware.

So if it's critical, you need to go a lot further than the warranty is ever going to do for you. And then if it's not, why pay the extra money for that? That goes double .

if it's critical in the sense of the machine, as IT is currently can figure, doing the job that is actually doing, because what an awful lot of microlights s have discovered, to their great dismay over the years, is when you invite that deler hp service technician on premises and you show them the machine, say, this is the one with the bad U. S. B port. You're very likely to get a reim ge where you wanted IT or not. And they may not even bother asking you first because it's usually corporate policy, just reimagine thing you touch the many dance on.

And especially if you're setting IT away for two to three weeks, get repair yeah don't extend your files to be on them when you gets back is probably not even going to be the same hardwork.

And so to that end, i've taken a lot of times to purposely buying things without the warranty, like looking at silver part deals or something similar for buying hard drives, knowing that ah I going to use this hard drive until he dies, most likely going to die after the warning is over already. And even if that does die before that i'm likely gonna want to buy whatever the current best dollar Peterel drive is at the time, not this model that's old now. And so I most of time not going to bother with the warm or especially being in canada.

It's going to be a pain to ship IT back to the U. S. Anyway, and it's going to take extra time. And it's just not worth IT for a free hard drive when I have a lot of hard drives. And so buying things where you're not spending the extra money on the warranty means that I can just afford to have a couple of spare instead. And then my water revoting time is the time I take me to physically go and do IT, and that can be a lot Better.

And on the flip side, we're talking about especially things that are target toward consumers and like you don't really have the option of buying IT without the warranty.

A lot of the time, sometimes I will look for a longer warranty being offered, not because I ever plan on using IT because to me, that's an indication of that manufacturer is more likely to actually be engineering that part of that device to last for longer because there is a non zero o cost involved in offering, you know a three year warranty or a five year warranty. You actually have replace things when people tell you they're broken within that time frame and need replacing. So if somebody y's offering a five, you are warranted.

You know there is is expecting the majority of the stuff to ask her three years, even if they they figure most people won't do anything with their are warranty, which lets be honest again, a special with i'm about consumer devices. The majority device is the failed under warranty, don't get replaced under warranty that consumers just chuck the skip. However, again, there is a percents that will actually prediction on that warranty.

And because wherever you have to be incorporate is going to force you to honor. The warranty that you offered, like I said, you know, IT definitely a longer warranty implies engineering for longer lasting. And that will mean something to me even if I never, ever, ever planned on actually using the warranty, right?

Well, we want to get out of her then, remember, show a two of five amin stock com who wants to send any questions or feedback. You can find me a geest com slash meter on.

You can find me a mercenary s adman dom.

And i'm at a jude.

Was he next week?