[pca] Quarterly patch schedule

[Jeff A. Earickson]

My two cents here...  Yuck!!  I want patches as soon as they are 
available, not quarterly.  And I sure don't want the big bloated patching
scheme that Oracle uses, where they package everything into a multi-GB, 
java gui frontended monster of a download file that you can't find room
for on your system.

We are not an Oracle shop, and the only other Oracle product that we use
is Oracle calendar (formerly Steltor Corporate Time, before they were 
bought out by Oracle).  I almost never patch Oracle calendar because Oracle
turned that into a horror show.  First, in order to find what patches are
available, I have to log a support call with Oracle to even find that out
(Oracle's webpage is opaque, but getting a little better).  Then I have to 
download a multi-GB file and run a GUI, which means I have to find space for
the patch file and get the GUI to work with my Java du jour and X-windows.
For Oracle calendar, which is behind a firewall (and which I keep hoping
to get rid of), it isn't worth the bother.

Sun/Oracle if you are listening:

* keep it small
* keep it simple
* keep it command-line

Sun Patch Manager was none of these, which caused me to dump 80% of my
Sun boxes for Redhat.  PCA saved the remaining 20%, once I found it.

If Oracle frigs up Solaris patching then I have bought my last Sun box.

Jeff Earickson
Colby College

On Fri, 9 Apr 2010, Dave Stark wrote:

> Date: Fri, 09 Apr 2010 21:17:38 +0100
> From: Dave Stark <dave at davidstark.name>
> Reply-To: "PCA (Patch Check Advanced) Discussion" <pca at lists.univie.ac.at>
> To: pca at lists.univie.ac.at
> Subject: Re: [pca] Quarterly patch schedule
> 
> Now that's interesting. Quite welcome I think in my case (should make the 
> audit box-ticking exercises a lot simpler, and give the Admins some leverage 
> for regular patching downtime), but perhaps not so welcome for those with 
> machines on hostile networks if they have to wait months for security 
> patches.
>
> I wonder if this'll change the way patches will be delivered in the future. 
> Does this spell the end of patchdiag.xref if patches are released in big 
> chunks? Back to the Recommended Patch Clusters maybe.
>
> I'm not familiar with how Oracle releases patches for its database - do they 
> issue out-of-cycle emergency patches for high severity security bugs (the 
> famous in-as-root Solaris telnet bug springs to mind)?
>
> Hmmmm.
>
> Dave
>
>> New quarterly patch schedule.
>> 
>> http://www.pcworld.com/article/193865/suns_solaris_now_getting_quarterly_security_patches.html?tk=rss_news
>> 
>> 
>> 
>> Thanks
>> 
>> Ying Xu<yxu at littonloan.com>
>> Unix Group
>> Office: 713-218-4508
>> BB: 832-671-6633
>> 4828 Loop Central Dr. Houston TX 77081
>
>
>