Outside of announcements about critical security flaws, is a period of one month between Arch Linux updates (pacman -Syu) dangerous in terms of security?


It's difficult to say, because it really depends on what happens in the world. In most cases, monthly updates to a machine (with the occasional exceptions for major security issues) should be fine. However, it's a calculated risk. The time you spend between each update is time when your system is potentially vulnerable.

Another piece is just how big of a target you are and what exactly you're running. If you're a huge target (e.g. Google) and running internet-facing servers, you almost certainly should be patching your servers as soon as you feasibly can. If, on the other hand, you're a private individual just running a desktop at home behind a firewall, your likelihood of being the target of an attack goes down massively.

In the end, I'm not sure this is an answerable question. Strictly speaking, the answer is "yes, any time between the update being available and you running updates is time when you're vulnerable." But from a practical standpoint, your risk may be very low (depending on your situation). And that risk calculation isn't something you should be trusting some random person on the internet with.

  • Good answer. I think - patching every day and booting after kernel or glibc-updates would be a good compromise. – Nils Nov 27 '19 at 13:25

It really depends on what you are running. In any case, you should periodically (every week or so) check the Arch Linux homepage to ensure there are no critical updates pending for your machine.

Not the answer you're looking for? Browse other questions tagged or ask your own question.