53 points plaur782 2 hours ago 5 comments
zulux 1 hour ago | parent
Mega patches like this, in my opinion, should be treated as mandatory patches. If I were trying to get a significant security update into the field in the age of LLM drama, this is how I would do it.
ltbarcly3 41 minutes ago | parent
So you're in favor of applying security patches? Controversial opinion.
fock 18 minutes ago | parent
then, what would you do if you were an adversary trying to push your xz-style vulnerability to every place known to man?
levkk 3 minutes ago | parent
Most databases run offline and don't allow arbitrary SQL statements. SQL injections are generally eliminated by using the extended protocol.
So, yes, if you're running multi-tenant Postgres as a public service, you should upgrade. Everyone else is in no rush.
simonw 32 minutes ago | parent
"This release fixes 52 security vulnerabilities and over 140 bugs reported over the last several months."