4 ms·
Here's the official place where these are announced, if you feel a little uneasy getting urgent security advisories from tweets and blogs: https://mta.openssl.
by jrootabega 4y ago
Here's the official place where these are announced, if you feel a little uneasy getting urgent security advisories from tweets and blogs:
https://mta.openssl.org/mailman/listinfo/openssl-announce https://mta.openssl.org/mailman/listinfo/openssl-announce
- rav 4y agoHere's a direct link to the 3.0.7 announcement in the archive: https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html https://mta.openssl.org/pipermail/openssl-announce/2022-Octo...
- _hyn3 4y agoYour point stands, but FWIW, this is actually Globalsign GMO[0], one of the largest TLS certificate authorities (CA's), so certainly they have a vested interest in making sure OpenSSL is secure. (Globalsign also partnered with CloudFlare for TLS certificates[1]) 0. https://en.wikipedia.org/wiki/GlobalSign https://en.wikipedia.org/wiki/GlobalSign 1. https://techcrunch.com/2012/11/01/cloudflare-globalsign-make-ssl-faster/ https://techcrunch.com/2012/11/01/cloudflare-globalsign-make...
- jrootabega 4y agoI don't think the post is inaccurate or the authors untrustworthy, but I don't think it's a good idea to rely on their blog to get OpenSSL alerts, especially when there is an official, high signal-to-noise, alternative. If someone reads this HN submission and wants to make sure they get alerted about the next critical vulnerability, they should subscribe.
- greggsy 4y agoIt’s not practical to subscribe to security feeds for every OSS project. Keeping in touch with the tech community is a valid alternative, in combination with patching best practice.
- jrootabega 4y agoIt's not wise to subscribe to none.