Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer

BakedCatboy@lemmy.ml ⁨1⁩ ⁨day⁩ ago

• CatLikeLemming@lemmy.blahaj.zone ⁨2⁩ ⁨hours⁩ ago

  You mean watchtower by containrrr? That repo seems archived.

  Also, if you don’t mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?

  source

  • BakedCatboy@lemmy.ml ⁨22⁩ ⁨minutes⁩ ago

    I use one of the maintained forks of watchtower.

    I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don’t think I’ve experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I’m not sure if that’s safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.

    source
  • MangoPenguin@lemmy.blahaj.zone ⁨1⁩ ⁨hour⁩ ago

    If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup if it really went wrong and I can’t recover otherwise.

    Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.

    source