Re: openssl freak

 

On 23/03/2015 21:18, Didier Spaier wrote: 

> On 23/⁠03/⁠2015 06:55, Noel Butler wrote: On 23/⁠03/⁠2015 14:37, Didier Spaier wrote:
> 
> On 23/⁠⁠03/⁠⁠2015 02:24, Nick Edwards wrote: Has Pat gone on holidays?
> 
> All our other 3 distros did the urgent openssl updates 3 days ago,
> even stuffbuntu did it 2 days ago *sigh*
> 
> slack is being slack :-⁠⁠> 
> Follow the Slackware Security thread on LQ and don't spread FUD.
> 
> Thanks in advance,
> Didier
 Openssl did issue an urgent warning saying they underestimated the
 severity of freak, and found other critical nasties and released yet
 again more patched versions a few days back, so he's hardly spreading
 FUD, he's speaking truth.
 unless there is some magical secret NSA proxy cache involved, my
 updates, nor my slackware mirrors, have had updates with those new
 versions, Pat is not always the fastest with updates of stuff, and in
 fact can be weeks after other major distros at times -⁠ but with
critical
 stuff (eg: openssl) he has been just as fast as other distros (eg: RH),
 just not this time... perhaps he went away for a well deserved long
 weekend of R&R... 
 I stand by my words, but probably need to elaborate a bit.

 Nick's post, as is, doesn't convey any usable information but looks
like
 just a rant. That's why I called it FUD. I admit though that English is
not
 my native language and maybe I should have worded my answer
differently.

 Anyhow, here are things that I would have considered constructive:
 _email Pat (maybe he did?), just in case he didn't came across the
advisory
 _link to the post from mancha:
http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635
[1]

 Please note that mancha's post provides a link to the advisory,
 and to the source tarball to be used to upgrade: _that_ is useful.

 Now both of you, seasoned Slackware users as you are, know how to
rebuild
 a package against a new source tarball then reinstall it, don't you? 

thats besides the point, yes I can do so, and have done so with other
packages Pats been a bit late with, but plenty others wont be so
confident. 

> Also, please consider that according to mancha whom I trust,
> there is no vulnerability rated High in versions shipped in
> Slackware.
> And of course RH who has maintenance contracts with its
> customers is expected to be the fastest to provide patched
> packages.
> 
> Best regards,
> Didier

I dont read linuxquestions - I cant be bothered with all the HTML candy
of forums, its why I prefer lists and usenet, I get what I want in a few
k, not a few hundred k, (repeated for everytime time you login to view
the thread) 

you might know and trust mancha, but I dont know him/her form a bar of
soap, I know the names of the slackware crew, and they are the only
names I trust apart from upstreams, so if openssl say there is high
severity, then there is high severity regardless of what your friend
says :) 

 

Links:
------
[1]
http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635

_______________________________________________
slackware mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/slackware