Amahi Forums

Greetings,

I just installed Amahi on a Fedora 14 box about a week ago. My simple, ye, possibly silly, question is whether or not upgrading the F14 base software is advisable to do once Amahi is installed. From a security point it make sense since vulnerabilities are quite likely to exist, however will it break anything in Amahi. I did a "quick" yum update, and the number of packages available for update is generous to say the least.

Any advise is definitely welcomed and encouraged. Thank you.

I would recommend you do the yum update. I run my HDA with all the latest and never have any problems.

Who would seriously have a server running 24/7 with no security fixes???

The Amahi developers must be out of their minds endangering user data in such a way by disabling the update feature.

And then they are so late with the version update to Fedora 16, that there now isn't any way at all to get security fixes anymore (for several months now), as Fedora 14 isn't supported anymore. We are running a server on an end of line OS that isn't getting any security fixes anymore, since months!!! How could you let this happen? Where was the planning?

I know Amahi is a community project, and I respect this and am thankfull for the great work being done. But seriously guys, to get some respect as a Home Server the first basics is that security fixes must be applied. And if you can't handle the Fedora update schedule (then why did you chose Fedora???), then move on to Ubuntu LTS which has 5 years support.


I hope I got your attention. Thanks again for the great work you are all doing.


PS: Imho, the HDA should check for updates daily, and have an option in the web UI to send an email to inform the user. This way we wouldn't need to check it manually all the time.

Hi,

i totally agree with bigmango.
It's essential for a server to keep up to date from a security point of view. And this is not the only security concern i have (storing configuration parameters in a DB without the possibility to change the well known password is one of the others).

Fedora 17 is in Beta state and will be released soon. So working on a migration to Fedora 16 is like riding on a dead horse.

Ok, i understand that this is just a question of man power. When more people would contribute, amahi could perform much better.

That's one of the reasons why i'm thinking about to delete amahi from my box and set up a "normal" server based on debian, fedora oder ubuntu.

The other think i really don't like about amahi is, that is completly mess up with conventions.
E.g. on a normal system all configurations are stored in /etc.
Yesterday i want to configure my DLNA and found the config file in /var/hda/apps/
That far away from any standard as i know.

What i love the most on my HDA is greyhole. But this could be easily set up on another Linux box.


Regards

Juergen

Who would seriously have a server running 24/7 with no security fixes???

The Amahi developers must be out of their minds endangering user data in such a way by disabling the update feature.

I kind of disagree. Amahi is not meant to be a highly secure server or be out on the internet bare naked. We have gone through this and this was our experience:

All the updates were being very disruptive. In fact, it posed more risks to simply update automatically, so we left it to the users and their level of experience. Our motto: it's your box. Amahi just helps manage it.

The compromise is this: we look at all the updates as they are coming and we (the community) look at the severity of any issues coming in to see if they merit an update. Amahi has the mechanism to rev new updates coming upstream via a package called hda-suite that can pull dependencies if we have to.

We only had to do this once ever with a major issue with DNS cache injections coming from upstream servers. The whole linux world was affected by this and even then it was a very very very small risk.

And then they are so late with the version update to Fedora 16, that there now isn't any way at all to get security fixes anymore (for several months now), as Fedora 14 isn't supported anymore. We are running a server on an end of line OS that isn't getting any security fixes anymore, since months!!! How could you let this happen? Where was the planning?

I know Amahi is a community project, and I respect this and am thankfull for the great work being done. But seriously guys, to get some respect as a Home Server the first basics is that security fixes must be applied. And if you can't handle the Fedora update schedule (then why did you chose Fedora???), then move on to Ubuntu LTS which has 5 years support.


I hope I got your attention. Thanks again for the great work you are all doing.


PS: Imho, the HDA should check for updates daily, and have an option in the web UI to send an email to inform the user. This way we wouldn't need to check it manually all the time.

There is no "they" ... it's "us". We lead the team, but you can too!
do installs, send in patches. come to the IRC and chip in ... there is a lot of work.

In fact, we're looking at ways to make Amahi smaller, as all the things going on (from hosting, to emailing, to spammers, to app ratings, app quality, app testing, participating in some upstream activities, multiple architectures and OSs, etc.), are making us go slower than we'd like.

On the other hand, servers keep on running. There is no massively compelling reason to jump on the latest and be always on unstable ground.

That said, the difficulties that Fedora 16 has given us so far in how yum has shown signs of instability may lead us to jump on Fedora 17. Let's hope it's a solid release!

So, join in and help us move faster!

Edit: All that said, the idea of having a checkbox or something to make updates automatic for advanced users is a great idea.