Upcoming OpenSSL severe bug fix

KOM

When will the software industry get serious about security and code review-testing?

If security was easy & cheap, everyone would be doing it right.

divsys

Reminds me of the universal solution matrix for problem solving:

Good
Inexpensive
Fast

- Pick any two

Harvy66

The funny thing is tech debt makes inexpensive and fast more expensive in the long run for any core infrastructure.

KOM

I have yet to meet a manager that has 1) a grasp of technology and, 2) an appreciation of the difference between hard and soft costs: "Get the cheaper thing even though it will cost us many more hours over the course of each year. The $50 one-time savings is definitely worth it."

Harvy66

Seems we got some more info on it

http://arstechnica.com/security/2015/07/critical-openssl-bug-allows-attackers-to-impersonate-any-trusted-website/

jimp

Despite wanting my name to succeed, someone has dubbed this OprahSSL and I'm inclined to agree.

jimp

FreeBSD has fixes in, ~~new snapshots of 2.2.4 will be out soon that have the problem corrected.~~

https://www.freebsd.org/security/advisories/FreeBSD-SA-15:12.openssl.asc

Actually upon closer examination, we aren't affected. The version in pfSense 2.2.x is before the affected feature was added. The fix in FreeBSD is only for 10-STABLE after a specific date.

So no worries, folks. Just sit back and laugh at everyone else.

KOM

Just sit back and laugh at everyone else.

Everyone else? From what I have read, hardly anybody was using the June library anyway so its effect is expected to be very limited.

jimp

@KOM:

Just sit back and laugh at everyone else.

Everyone else? From what I have read, hardly anybody was using the June library anyway so its effect is expected to be very limited.

Ssshhhh… don't kill the mood. It's a rare day we get to practically ignore an OpenSSL SA. :-)

dennypage

@jimp:

Ssshhhh… don't kill the mood. It's a rare day we get to practically ignore an OpenSSL SA. :-)

:)