Re: openssl freak

What a funny discussion this is,


On 23/03/2015 12:54, Noel Butler wrote:
>
> On 23/03/2015 21:18, Didier Spaier wrote:
>
>>
>>
>> On 23/⁠03/⁠2015 06:55, Noel Butler wrote:
>>> On 23/⁠03/⁠2015 14:37, Didier Spaier wrote:
>>>
>>>>
>>>>
>>>> On 23/⁠⁠03/⁠⁠2015 02:24, Nick Edwards wrote:
>>>>> Has Pat gone on holidays?
>>>>>
>>>>> All our other 3 distros did the urgent openssl updates 3 days ago,
>>>>> even stuffbuntu did it 2 days ago *sigh*
>>>>>
>>>>> slack is being slack :-⁠⁠>
>>>>
>>>> Follow the Slackware Security thread on LQ  and don't spread FUD.
>>>>
>>>> Thanks in advance,
>>>> Didier
>>> Openssl did issue an urgent warning saying they underestimated the
>>> severity of freak, and found other critical nasties and released yet
>>> again more patched versions a few days back, so he's hardly spreading
>>> FUD, he's speaking truth.
>>> unless there is some magical secret NSA proxy cache involved, my
>>> updates, nor my slackware mirrors, have had updates with those new
>>> versions, Pat is not always the fastest with updates of stuff, and in
>>> fact can be weeks after other major distros at times -⁠ but with critical
>>> stuff (eg: openssl) he has been just as fast as other distros (eg: RH),
>>> just not this time... perhaps he went away for a well deserved long
>>> weekend of R&R...
>>
security of your box is your job, not some maintainers

>> I stand by my words, but probably need to elaborate a bit.
>>
>> Nick's post, as is, doesn't convey any usable information but looks like
>> just a rant. That's why I called it FUD. I admit though that English is not
>> my native language and maybe I should have worded my answer differently.
>>
>> Anyhow, here are things that I would have considered constructive:
>> _email Pat (maybe he did?), just in case he didn't came across the advisory
>> _link to the post from mancha:
>> http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635
>>
>> Please note that mancha's post provides a link to the advisory,
>> and to the source tarball to be used to upgrade: _that_ is useful.
>>
>> Now both of you, seasoned Slackware users as you are, know how to rebuild
>> a package against a new source tarball then reinstall it, don't you?
Here is the SlackBuild
http://slackware.osuosl.org/slackware_source/n/openssl/

Here are the sources:
http://openssl.org/source/openssl-1.0.1m.tar.gz

Took not even 5 minutes to update ...
> thats besides the point, yes I can do so, and have done so with other 
> packages Pats been a bit late with, but plenty others wont be so 
> confident.
>>
>> Also, please consider that according to mancha whom I trust,
>> there is no vulnerability rated High in versions shipped in
>> Slackware.
>> And of course RH who has maintenance contracts with its
>> customers is expected to be the fastest to provide patched
>> packages.
>>
>> Best regards,
>> Didier
>>
> I dont read linuxquestions - I cant be bothered with all the HTML 
> candy of forums, its why I prefer lists and usenet, I get what I want 
> in a few k, not a few hundred k, (repeated for everytime time you 
> login to view the thread)
at first I thought "It's 2015 so what?"

but then I saw why the message went straight to the Spam folder :) :

HTML_MESSAGE BODY: HTML included in message 0.0 UNPARSEABLE_RELAY 
Informational: message has unparseable relay lines Scanned on host 
mail-in-01.lug.org.uk


LQ is mentioned somewhere as official Slackware support site btw.

> you might know and trust mancha, but I dont know him/her form a bar of 
> soap, I know the names of the slackware crew, and they are the only 
> names I trust apart from upstreams, so if openssl say there is high 
> severity, then there is high severity regardless of what your friend 
> says :)

But seriously and no matter who is trusting who, people *should* update 
immediately, the number of fail2ban messages since last night
has increased  enormously.

So  go to work eberybody :)

-- 

_______________________________________________
slackware mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/slackware