An old server decided to mail me about a filesystem space problem it had. Before logging in my first thought was “is this server still alive?”. While checking things up, I’ve noticed too many processes had “2010 ?” in their STIME column of ps, which made me check when was the last reboot.
The results talk for themselves.
# uptime
23:51:06 up 636 days, 8:36, 1 user, load average: 0.12, 0.43, 0.33# who -b
system boot 2010-11-11 14:15# cat /etc/debian_version
4.0
Sweet (:
With these records, no wander I could forget about it…
Free Software Universe 
So you’re proud of running a server without security updates for more than two years?
I’m proud that the system can keep on working for two years without interruption.
Actually it is not that hard if the system does almost nothing – and if you don’t remember if it is alive than it really does nothing (but wastes electricity power)
On the other hand… it is a system that hadn’t been updated/patched for 2 years that likely to include many holes.
So I wouldn’t be proud for that.
Once there was a competition who has longer uptime (or less unpatched system) as that means that at least kernel was not update for a long time.
I’m proud to live in a perfect world 🙂
$ uptime ; cat /etc/debian_version
11:53:26 up 686 days, 13:46, 1 user, load average: 0.00, 0.00, 0.00
testing/unstable
I suppose that as long as ‘unattended-upgrades’ is installed and properly configured to run at least weekly, including to let you know if/when it installed anything, it could remain safe enough.
Except you won’t get kernel updates that way and there are no security updates for Debian 4.0 (etch) anymore… (And if I remember correctly, unattended-upgrades wasn’t in etch at all)