-2

I am running an application on my server with the help of Nodejs, and it has many dependencies such as Chrome.

I have not updated my server for two years. I am afraid that if I do, my code will fail and I have no means of reverting it back to before the updates.

Is it bad practice to not update the server? What is the appropriate thing to do in production env?

Improve this question
2
  • 3
    It's a bad thing. You're likely to have known vulnerabilities. Updating should be a regular process - and that includes maintaining your application. When it comes to run environment you may look into docker to create reproducible environments, but that doesn't change the need for maintenance.
    – vidarlo
    Nov 8 at 11:38
  • 1
    You are flying without a safety net and [rightly] worrying about whether termites are now eating away at your trapeze. You absolutely must have a TEST Environment in which to manage issues like this. Only when your application is stable on the new updates do you release them all into Production. Our software may not "rot", but it does get undermined by the "shifting sand" that we build upon. "Maintenance" is NOT a dirty word. It's a fact of the Developers' Life!
    – Phill W.
    Nov 8 at 14:21

1 Answer 1

Reset to default
5

Yes, it is always a bad idea to ignore updates, as this will make your server vulnerable to known exploits / zero-days (And by the way, it is possible to revert an update in linux).

Your considerations are exactly the reason why the choice of the linux distribution is important in the first place. If you stay at a specific version (lets say ubuntu 22 LTS for example), the updates available to this distribution are only bugfixes and security updates, so that it is guaranteed (more or less), that any call to a function published by any library will do the same before and after the update.

Choosing a LTS version (Long-Term Support) will ensure that your version will receive updates for a longer time-span, because doing a distribution update can be cumbersome. Every Distributor publishes its release plan, which gives you the EOL date for that distribution (after this date, you have to perform a distro-upgrade to continue receiving updates).

Improve this answer

Not the answer you're looking for? Browse other questions tagged .