alt Hacker NewsA hot take - agents with root access dynamically updating your system have crossed over the threshold of being more secure than not using them.
I still haven't done this for my servers with SOC2 compliance (for obvious reasons), but I've moved over my personal project servers to this pattern. They all run ubuntu and this CVE was fixed within 1hr of my agent seeing chatter on twitter about it.
Still in the testing phase of this pattern, but while I initially thought it'd be a terrible idea[1], I'm coming around to it more and more with the amount of major CVEs hitting.