Hacker News Reader

Comment by zck | Hacker News Reader

I'm no security expert, so this is an honest question.

Why was Tarsnap running a version of OpenSSL that's at least two years old^1 ? My understanding is that, while you might not want to upgrade immediately upon release (because there may be new bugs), neither should you never upgrade (because releases fix old bugs).

Is it because the website itself doesn't do much -- it's not the business; backup is -- so not much time is put into it?

[1] OpenSSL 1.0.1, the first version of OpenSSL with the bug, was released in March 2012: http://heartbleed.com/

View on HN

OpenSSL frequently hosts vulnerabilities that don't affect all users of TLS. If you pay attention to the updates (as Colin surely does), you can filter down to the updates that matter.

It's a risky thing to do if you're not willing to own those judgement calls; I wouldn't recommend that most shops do that. Among other things, you need to eyeball the diffs.

Or he is running an older version of FreeBSD that contains an older version of OpenSSL in the base.

For what it's worth: he's the former FreeBSD security officer, so I wouldn't worry too much about which version of FreeBSD he's using.

It isn't that much older... stable/9 was the latest until 10 came out within the last year. The release cycle is closer to, say, Debian, than, say, Fedora.

FreeBSD 10 was just released, January 2014 if I remember correctly.

I've been hearing about it from some FreeBSDers for months before that, so I can never remember the actual release date. But I would believe you on January :).

The release was in January, but a lot of us were running Betas and Release Candidates for about three months prior to that.

JeffR sounded pretty busy with preparing those betas and RCs, iirc. ;)

The Tarsnap website is running on FreeBSD 9, which gets OpenSSL bug fixes backported.

Security fixes are usually backported for affected versions, and presumably Colin installed these updates. This depends on the distribution you choose and if you are running a release where they have guaranteed critical updates (i.e. Ubuntu LTS releases).

What you do miss out on is new protocol support, which for TLS can be a huge problem when secure and compatible crypto options run out.

(Sadly, people will usually err on the side of compatibility, which in the past boils down to the terrible RC4)

Can't answer for Tarsnap specifically, but older (unaffected) OpenSSL versions are shipped by various distributions that are still supported, for example Ubuntu 10.04 LTS. There's nothing wrong with sticking to LTS releases IMO.

SuSE Enterprise linux for example is still on 0.9.8, moving from 0.9.8 to 1.0 for a distro is a non trivial amount of work.

Some of these distros are LTS, so the bug fixes are usually back ported. The latest 0.9.8 is y which is from Feburary 2013.

This is common for the "enterprise" distributions. They adopt new packages very slowly, preferring to backport security patches. Much to the aggravation of developers who want to be able to use the lates and greatest of something only to find that the RHEL production environment doesn't offer it.

Also it should be mentioned: OSX Mavericks has 0.9.8y

Much to the aggravation of developers who want to be able to use the lates and greatest

Upgrading OpenSSL introduces other problems though -- the OpenSSL developers don't seem to understand the concept of a "stable branch" or "binary compatibility", so importing a new version of OpenSSL can mean that everything which links against it has to be recompiled. This is one of the reasons why FreeBSD doesn't get major OpenSSL updates on stable branches -- our policy is that if a binary worked on X.0, you should be able to run it on all future X.* releases.

there are multiple branches that are developed simultaneously and have bugfixes backported. My CentOS box is on 0.9.8.

Reply on news.ycombinator.com