Post a Comment
It's gratifying to see that openSUSE managed to escape the list of glaring security problems. Congrats to the dev teams, I believe their holistic approach to assessing vulnerabilities gives them a clear advantage over the distros listed in the article.
FWIW, the bug with the decoder rings in Fedora was admittedly an issue with an earlier version of openSUSE, but it was very quickly identified and nixed with a security update. It's remarkable to see that other distros fail, even in this day and age, to take preventative measures against well known attack vectors. Don't even get me started on the root access vulnerability for slackware that was mentioned in the article, how has that not been addressed yet?
Security is a mindset, above all else.
;)
Security is a mindset, above all else.
;)
Well, if your running Slackware 12.0, then yes, your most likely vulnerable, but it has been addressed with the release of 12.1, unless there is an issue with openssl-0.9.8g itself.
I'm a little surprised not to see a link on OSNews to the incident that inspired this comic. Maybe the editors knew it would turn into a flamefest. Seriously though, it's somewhat of a major story. I'm a Debian user myself, and I'm really horrified at the bug one of their developers introduced to their version of OpenSSL.
It's one of those things that makes one think about distros and their relationship to upstream, about whether one's distro choice is sound, about how easy it is to trust code, etc etc. Seems like something that should be addressed on OSNews, even if it might be a crapstorm. Apologies if I missed it somewhere..
Arch seems to currently add three patches to their openssl package.
http://repos.archlinux.org/viewvc.cgi/openssl/repos/core-i686/
Some Arch packages, like firefox, have more patches.
http://repos.archlinux.org/viewvc.cgi/firefox/repos/extra-i686/








