Re: openssl freak

On 23/03/2015 12:54, Noel Butler wrote:
> On 23/03/2015 21:18, Didier Spaier wrote:
>
>>
>>
>> On 23/⁠03/⁠2015 06:55, Noel Butler wrote:
>>> On 23/⁠03/⁠2015 14:37, Didier Spaier wrote:
>>>
>>>>
>>>>
>>>> On 23/⁠⁠03/⁠⁠2015 02:24, Nick Edwards wrote:
>>>>> Has Pat gone on holidays?
>>>>>
>>>>> All our other 3 distros did the urgent openssl updates 3 days ago,
>>>>> even stuffbuntu did it 2 days ago *sigh*
>>>>>
>>>>> slack is being slack :-⁠⁠>
>>>>
>>>> Follow the Slackware Security thread on LQ  and don't spread FUD.
>>>>
>>>> Thanks in advance,
>>>> Didier
>>> Openssl did issue an urgent warning saying they underestimated the
>>> severity of freak, and found other critical nasties and released yet
>>> again more patched versions a few days back, so he's hardly spreading
>>> FUD, he's speaking truth.
>>> unless there is some magical secret NSA proxy cache involved, my
>>> updates, nor my slackware mirrors, have had updates with those new
>>> versions, Pat is not always the fastest with updates of stuff, and in
>>> fact can be weeks after other major distros at times -⁠ but with critical
>>> stuff (eg: openssl) he has been just as fast as other distros (eg: RH),
>>> just not this time... perhaps he went away for a well deserved long
>>> weekend of R&R...
>>
>> I stand by my words, but probably need to elaborate a bit.
>>
>> Nick's post, as is, doesn't convey any usable information but looks like
>> just a rant. That's why I called it FUD. I admit though that English is not
>> my native language and maybe I should have worded my answer differently.
>>
>> Anyhow, here are things that I would have considered constructive:
>> _email Pat (maybe he did?), just in case he didn't came across the advisory
>> _link to the post from mancha:
>> http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635
>>
>> Please note that mancha's post provides a link to the advisory,
>> and to the source tarball to be used to upgrade: _that_ is useful.
>>
>> Now both of you, seasoned Slackware users as you are, know how to rebuild
>> a package against a new source tarball then reinstall it, don't you?
> thats besides the point, yes I can do so, and have done so with other
> packages Pats been a bit late with, but plenty others wont be so confident.
>>
>> Also, please consider that according to mancha whom I trust,
>> there is no vulnerability rated High in versions shipped in
>> Slackware.
>> And of course RH who has maintenance contracts with its
>> customers is expected to be the fastest to provide patched
>> packages.
>>
>> Best regards,
>> Didier
>>
> I dont read linuxquestions - I cant be bothered with all the HTML candy
> of forums, its why I prefer lists and usenet, I get what I want in a few
> k, not a few hundred k, (repeated for everytime time you login to view
> the thread)

I can understand that, furthermore linuxquestions is unreadable for
some folks, e.g. those who have to use a CLI browser like links or
lynx because being blind they can't rely on a GUI.

So here are the links copied from mancha's post:
_Solution for 12.0-13.37: Upgrade to OpenSSL 0.9.8zf
_Solution for 14.0-current: Upgrade to OpenSSL 1.0.1m
http://openssl.org/source/openssl-0.9.8zf.tar.gz
sig; http://openssl.org/source/openssl-0.9.8zf.tar.gz.asc
http://openssl.org/source/openssl-1.0.1m.tar.gz
sig: http://openssl.org/source/openssl-1.0.1m.tar.gz.asc


> you might know and trust mancha, but I dont know him/her form a bar of
> soap, I know the names of the slackware crew, and they are the only
> names I trust apart from upstreams, so if openssl say there is high
> severity, then there is high severity regardless of what your friend says :)

Only you can choose who you trust, of course. Please note though that
in this case appreciation of the severity is not that of mancha
but that of upstream for the versions shipped in Slackware.

Best regards,
Didier

_______________________________________________
slackware mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/slackware