> I can't remember the last time I was aware of a security problem before Red Hat (and CentOS) had rolled out a fixed package. I usually know about security iss

> I can't remember the last time I was aware of a security problem before Red Hat (and CentOS) had rolled out a fixed package. I usually know about security issues when I see a slew of update notifications from my servers (even though I'm on several security related mailing lists). Well looking at the last batch of OpenSSL security advisories, CVE-2015-3197 was reported and fixed by OpenSSL two days ago. [1] Yet it looks like RedHat has yet to issue a fix. [2] > Realistically, I rely on my OS vendor to provide my security fixes in a timely manner. If my systems security relied on me being able to apply patches manually in a timely manner, it would be a disaster waiting to happen. And, it is a big pile of labor I don't want on my plate. It's not difficult to subscribe to your OS vendors security mailing list as well as the security mailing list for ALL the software you run in production. [1]: https://www.openssl.org/news/vulnerabilities.html#y2016 https://www.openssl.org/news/vulnerabilities.html#y2016 [2]: https://access.redhat.com/security/cve/cve-2015-3197 https://access.redhat.com/security/cve/cve-2015-3197