Hacker News Reader

Here's the official place where these are announced, if you feel a little uneasy getting urgent security advisories from tweets and blogs:

https://mta.openssl.org/mailman/listinfo/openssl-announce

View on HN

Here's a direct link to the 3.0.7 announcement in the archive:

https://mta.openssl.org/pipermail/openssl-announce/2022-Octo...

Your point stands, but FWIW, this is actually Globalsign GMO[0], one of the largest TLS certificate authorities (CA's), so certainly they have a vested interest in making sure OpenSSL is secure. (Globalsign also partnered with CloudFlare for TLS certificates[1])

0. https://en.wikipedia.org/wiki/GlobalSign

1. https://techcrunch.com/2012/11/01/cloudflare-globalsign-make...

I don't think the post is inaccurate or the authors untrustworthy, but I don't think it's a good idea to rely on their blog to get OpenSSL alerts, especially when there is an official, high signal-to-noise, alternative. If someone reads this HN submission and wants to make sure they get alerted about the next critical vulnerability, they should subscribe.

It’s not practical to subscribe to security feeds for every OSS project. Keeping in touch with the tech community is a valid alternative, in combination with patching best practice.

It's not wise to subscribe to none.

Reply on news.ycombinator.com