3 ms·
While I can agree about over-hyping things, I've seen a lot of really, really ancient crap finally getting much-needed upgrades due to some of the hype, like De
by Natsu 12y ago
While I can agree about over-hyping things, I've seen a lot of really, really ancient crap finally getting much-needed upgrades due to some of the hype, like Debian Lenny, which hasn't had security updates for 3 years now.
Marketing vulnerabilities doesn't really sit well with me, but at least there's something of a silver lining. More people are actually paying attention to security and at work I've been helping clue people into better security practices. The status quo is pretty sad.
Though I grant I've seen some nonsense, too, likely generated by some sort of hype. For reasons I cannot explain, a lot of people suddenly want to do mutual auth against any old public CA-issued cert. It's not as if anyone can run s_client, find all the trusted issuers listed in the ServerHello (and possibly other random certs, because some people put the whole chain in there), and pay the CA a few bucks for a cert to auth with.
- nkuttler 12y agoLenny didn't get a security update for ghost. What you're thinking of is the LTS support effort [1] for a limited set of packages. It is maintained by a team of volunteers and is not an official project. Libc6 has had a few security upgrades by the LTS team in 2014. See both squeeze and LTS changelogs [2] for a comparison. It is important to note that if people still run squeeze they will NOT have LTS support out of the box, it has to be configured manually. [1] https://wiki.debian.org/LTS https://wiki.debian.org/LTS [2] http://metadata.ftp-master.debian.org/changelogs//main/e/eglibc/eglibc_2.11.3-4_changelog http://metadata.ftp-master.debian.org/changelogs//main/e/egl... http://metadata.ftp-master.debian.org/changelogs//main/e/eglibc/eglibc_2.11.3-4+deb6u4_changelog http://metadata.ftp-master.debian.org/changelogs//main/e/egl...
- Natsu 12y agoSorry, I'm not being clear here. I mean they were upgrading the OS to something newer, I'm not saying that Debian is (or should be) updating Lenny. That aside, it seems like you can use the squeeze-lts packages on Lenny.