Date: Tue, 10 Apr 2001 21:25:20 -0500 From: "Jeffrey J. Mountin" <jeff-ml@mountin.net> To: Nicole Harrington <nmh@daemontech.com> Cc: security@FreeBSD.ORG Subject: Re: Security Announcements? Message-ID: <4.3.2.20010410211055.02ce8470@207.227.119.2> In-Reply-To: <XFMail.010410154347.nmh@daemontech.com> References: <20010410215014.A8173@scientia.demon.co.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
At 03:43 PM 4/10/01 -0700, Nicole Harrington wrote: >On 10-Apr-01 Ben Smithurst wrote: > > Michael Nottebrock wrote: > > > > > >> It certainly is starting to irritate people running > >> 4.2-Release. > > > > Well if you want the latest security fixes you shouldn't be running a > > -release anyway, that's that the -stable branch is for. > > > > Thats the most stupid thing I have every heard. I never knew that simply by >running -STABLE I would not have any security problems and would not need >patches or updates. It certainly doesn't address *when* you should update, but in many cases the fix was long before the advisory. Both sides here have merit. However, relying on blind updates would be foolish. The advisory can also mean avoiding a complete build. > As someone who runs many production level servers here is what I would want > In order: > > 1) A notice that there is problem - So I can tcpwrap or shutdown said > service >until a patch is available. > > 2) A binary patch. Similiar to the Linux RPM.s and the BSDi patches. > Just download and run. No compiles no installs. > > 3) A patch that everyone agrees works in an email or other notification that >says, here's were you can get the patch, this works, here's what to do with >it. Assessment should be first. Do you use it and in some cases is it configured in such a way as to be vulnerable. There are times when checking the latter takes longer than applying the fix would have. Would also fixing only systems that use a service has a downside should the configuration change. Documentation is helpful. > From my perspective it took days for people to stop discussing what patch >was best for ntpd and I still never heard a full resolution on the mailing >list. No official blessing of a patch other than what I would get via >CVSUP. I >have production servers, I can't run a CVsup everyday, let alone a make >world. > > > Yes I may have missed a few mails or something. But expecting people to > spend >their days tracking down patches and notices abt problems kinda negates the >whole idea of a security mailing and notification. > The process seemed much better in the past, but lately, it has been much > less >than optimal. The NTP was a bit messy, but don't think it's changed much. Other than more often and the port specific one. In a few cases it did take a while for the fix and/or advisory. Hard to say with all the traffic. All I *do* know is that a higher number are likely to affect more systems. Or its just that the past year has exceeded the prior 5 for the number that concerned me. It might be the recent confusion with the typical advisory delay make things seem worse than they are or it is a case load issue, which in most cases this list covers it and most times becomes the official fix. Jeff Mountin - jeff@mountin.net Systems/Network Administrator FreeBSD - the power to serve To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.3.2.20010410211055.02ce8470>