Re: openssl freak

 

On 23/03/2015 22:36, Didier Spaier wrote: 

> On 23/⁠03/⁠2015 12:54, Noel Butler wrote: On 23/⁠03/⁠2015 21:18, Didier Spaier wrote:
> 
> On 23/⁠⁠03/⁠⁠2015 06:55, Noel Butler wrote: On 23/⁠⁠03/⁠⁠2015 14:37, Didier Spaier wrote:
> 
> On 23/⁠⁠⁠03/⁠⁠⁠2015 02:24, Nick Edwards wrote: Has Pat gone on holidays?
> 
> All our other 3 distros did the urgent openssl updates 3 days ago,
> even stuffbuntu did it 2 days ago *sigh*
> 
> slack is being slack :-⁠⁠⁠> 
> Follow the Slackware Security thread on LQ and don't spread FUD.
> 
> Thanks in advance,
> Didier
 Openssl did issue an urgent warning saying they underestimated the
 severity of freak, and found other critical nasties and released yet
 again more patched versions a few days back, so he's hardly spreading
 FUD, he's speaking truth.
 unless there is some magical secret NSA proxy cache involved, my
 updates, nor my slackware mirrors, have had updates with those new
 versions, Pat is not always the fastest with updates of stuff, and in
 fact can be weeks after other major distros at times -⁠⁠ but with
critical
 stuff (eg: openssl) he has been just as fast as other distros (eg: RH),
 just not this time... perhaps he went away for a well deserved long
 weekend of R&R... 
 I stand by my words, but probably need to elaborate a bit.

 Nick's post, as is, doesn't convey any usable information but looks
like
 just a rant. That's why I called it FUD. I admit though that English is
not
 my native language and maybe I should have worded my answer
differently.

 Anyhow, here are things that I would have considered constructive:
 _email Pat (maybe he did?), just in case he didn't came across the
advisory
 _link to the post from mancha:
http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635
[5]

 Please note that mancha's post provides a link to the advisory,
 and to the source tarball to be used to upgrade: _that_ is useful.

 Now both of you, seasoned Slackware users as you are, know how to
rebuild
 a package against a new source tarball then reinstall it, don't you?
thats besides the point, yes I can do so, and have done so with other
 packages Pats been a bit late with, but plenty others wont be so
confident. 

> Also, please consider that according to mancha whom I trust,
> there is no vulnerability rated High in versions shipped in
> Slackware.
> And of course RH who has maintenance contracts with its
> customers is expected to be the fastest to provide patched
> packages.
> 
> Best regards,
> Didier
 I dont read linuxquestions -⁠ I cant be bothered with all the HTML
candy
 of forums, its why I prefer lists and usenet, I get what I want in a
few
 k, not a few hundred k, (repeated for everytime time you login to view
 the thread) 
 I can understand that, furthermore linuxquestions is unreadable for
 some folks, e.g. those who have to use a CLI browser like links or
 lynx because being blind they can't rely on a GUI. 

So its not all browser capable? LOL - not designed by a true linux geek
then... 

I forgot to add the content is "deliverd right to me, I dont have to
remember to go to some dumb arse website all the time" :) 

> So here are the links copied from mancha's post:
> _Solution for 12.0-⁠13.37: Upgrade to OpenSSL 0.9.8zf
> _Solution for 14.0-⁠current: Upgrade to OpenSSL 1.0.1m
> http://openssl.org/source/openssl-0.9.8zf.tar.gz [1]
> sig; http://openssl.org/source/openssl-0.9.8zf.tar.gz.asc [2]
> http://openssl.org/source/openssl-1.0.1m.tar.gz [3]
> sig: http://openssl.org/source/openssl-1.0.1m.tar.gz.asc [4]

I've days ago updated from openssl, but countless masses would be
waiting on Pat with still no word I see. 

> Only you can choose who you trust, of course. Please note though that
> in this case appreciation of the severity is not that of mancha
> but that of upstream for the versions shipped in Slackware.

I've read the upstreams releases, I read it as severe, I guess you read
it as not. 
 

Links:
------
[1] http://openssl.org/source/openssl-0.9.8zf.tar.gz
[2] http://openssl.org/source/openssl-0.9.8zf.tar.gz.asc
[3] http://openssl.org/source/openssl-1.0.1m.tar.gz
[4] http://openssl.org/source/openssl-1.0.1m.tar.gz.asc
[5]
http://www.linuxquestions.org/questions/slackware-14/%5Bslackware-security%5D-vulnerabilities-outstanding-20140101-a-4175489800/#post5334635

_______________________________________________
slackware mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/slackware