Re: FLAME - security advisories on the 23rd ? uncool idea is unc

On Friday, December 23, 2011 11:07:56 am Damien Fleuriot wrote:
> Hey up list,
>=20
>=20
>=20
> Look, just a rant here.
>=20
>=20
> Who in *HELL* thought it would be a cool idea to release no less than
> FOUR security advisories today ?
>=20
> I mean, couldn't this have waited and remained undisclosed until monday ?
>=20
> I for one do *NOT* relish the idea of updating 50+ boxes this evening
> and tomorrow !
>=20
>=20
> Not to mention a whole lot of merchants and banks have toggled IT Freeze
> a few weeks ago, to ensure xmas shopping doesn't get disturbed by
> production changes.
>=20
>=20
> Seriously, this is just irritating.

=46rom an e-mail sent to security@ from the security officer:

<quote>
Hi all,

No, the Grinch didn't steal the FreeBSD security officer GPG key, and your =
eyes
aren't deceiving you: We really did just send out 5 security advisories.

The timing, to put it bluntly, sucks.  We normally aim to release advisorie=
s on
Wednesdays in order to maximize the number of system administrators who wil=
l be
at work already; and we try very hard to avoid issuing advisories any time =
close
to holidays for the same reason.  The start of the Christmas weekend -- in =
some
parts of the world it's already Saturday -- is absolutely not when we want =
to be
releasing security advisories.

Unfortunately my hand was forced: One of the issues (FreeBSD-SA-11:08.telne=
td)
is a remote root vulnerability which is being actively exploited in the wil=
d;
bugs really don't come any worse than this.  On the positive side, most peo=
ple
have moved past telnet and on to SSH by now; but this is still not an issue=
 we
could postpone until a more convenient time.

While I'm writing, a note to freebsd-update users: FreeBSD-SA-11:07.chroot =
has a
rather messy fix involving adding a new interface to libc; this has the awk=
ward
side effect of causing the sizes of some "symbols" (aka. functions) in libc=
 to
change, resulting in cascading changes into many binaries.  The long list of
updated files is irritating, but isn't a sign that anything in freebsd-upda=
te
went wrong.
</quote>

=2D-=20
John Baldwin
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"