Hacker News Reader

Comment by busterarm | Hacker News Reader

I have OpenSSL update fatigue.

Sadly this may be a feature of all cryptographic software.

Isolate your exposed services, give them push button deploys to get current versions out to each node as quickly as possible.

> Isolate your exposed services

Most important part. vulnerabilities need to get patched, period. But I'm a lot less stressed about it when I know my publicly exposed surface is small, and even that has layers in front of it.

I don't think the code that Bernstein writes has many vulnerabilities.

We all do. What distros is this affecting though? It seems like this is only in "recent" versions.

Aren't these the currently maintained versions? Anying pre-1.0.1 is no longer being maintained, and they note 1.0.1 will be going away soon too.

Quite right! I missed that bit.

    Note
    ====
    
    Support for version 1.0.1 ended on 31st December 2016. Support for versions
    0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
    receiving security updates.

It's not clear whether the first CVE (crash via OOB read) affects 1.0.1.

The OpenSSL team may not be maintaining them but some distros are.

Reply on news.ycombinator.com