Re: openssl freak

On 23/03/2015 06:55, Noel Butler wrote:
> On 23/03/2015 14:37, Didier Spaier wrote:
>
>>
>>
>> On 23/⁠03/⁠2015 02:24, Nick Edwards wrote:
>>> Has Pat gone on holidays?
>>>
>>> All our other 3 distros did the urgent openssl updates 3 days ago,
>>> even stuffbuntu did it 2 days ago *sigh*
>>>
>>> slack is being slack :-⁠>
>>
>> Follow the Slackware Security thread on LQ  and don't spread FUD.
>>
>> Thanks in advance,
>> Didier
> Openssl did issue an urgent warning saying they underestimated the
> severity of freak, and found other critical nasties and released yet
> again more patched versions a few days back, so he's hardly spreading
> FUD, he's speaking truth.
> unless there is some magical secret NSA proxy cache involved, my
> updates, nor my slackware mirrors, have had updates with those new
> versions, Pat is not always the fastest with updates of stuff, and in
> fact can be weeks after other major distros at times - but with critical
> stuff (eg: openssl) he has been just as fast as other distros (eg: RH),
> just not this time... perhaps he went away for a well deserved long
> weekend of R&R...

I stand by my words, but probably need to elaborate a bit.

Nick's post, as is, doesn't convey any usable information but looks like
just a rant. That's why I called it FUD. I admit though that English is not
my native language and maybe I should have worded my answer differently.

Anyhow, here are things that I would have considered constructive:
_email Pat (maybe he did?), just in case he didn't came across the advisory
_link to the post from mancha:
http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635

Please note that mancha's post provides a link to the advisory,
and to the source tarball to be used to upgrade: _that_ is useful.

Now both of you, seasoned Slackware users as you are, know how to rebuild
a package against a new source tarball then reinstall it, don't you?

Also, please consider that according to mancha whom I trust,
there is no vulnerability rated High in versions shipped in
Slackware.

And of course RH who has maintenance contracts with its
customers is expected to be the fastest to provide patched
packages.

Best regards,
Didier


_______________________________________________
slackware mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/slackware