Re: Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Benjamin Kaduk
On Thu, 5 May 2016, Julian H. Stacey wrote: > Benjamin Kaduk wrote: > > > As a member of the security team for two projects (not FreeBSD's, though), > > I can say that it is a lot of behind-the-scenes work to put out > > advisories, > > Of course. > > > and batching them reduces the unit cost of a

Re: FreeBSD Security Advisory FreeBSD-SA-16:17.openssl

2016-05-05 Thread Gleb Smirnoff
On Thu, May 05, 2016 at 09:38:26AM -0500, Mark Felder wrote: M> The freebsd-update mirrors do not have the latest updates for amd64 on M> any supported RELEASE. The i386 bits are there, but not amd64. I do not M> know if generating them failed or if something else happened that M> prevented their d

Re: Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Roger Marquis
Totally the opposite, it means one rollout instead of X rollouts making it simpler not harder. I don't know, isn't that the logic behind Microsoft's failed patch-Tuesdays? It's important not to confound security with usability. Any delay to a security advisory is an invitation to hackers. I d

Re: Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Eric van Gyzen
Julian suggested that I share our private conversation: Eric wrote: > Regardless of my opinion on the topic, three of these are errata with no > security implications, so the argument doesn't really apply in this context. Julian wrote: > Thanks Eric, fair point. So some of my argument doesnt a

Re: Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Steven Hartland
On 05/05/2016 17:25, Julian H. Stacey wrote: Benjamin Kaduk wrote: As a member of the security team for two projects (not FreeBSD's, though), I can say that it is a lot of behind-the-scenes work to put out advisories, Of course. and batching them reduces the unit cost of any given one. If

Re: Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Julian H. Stacey
Benjamin Kaduk wrote: > As a member of the security team for two projects (not FreeBSD's, though), > I can say that it is a lot of behind-the-scenes work to put out > advisories, Of course. > and batching them reduces the unit cost of any given one. If so, their issue, not ours. Our concern is

Re: Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Benjamin Kaduk
On Thu, 5 May 2016, Julian H. Stacey wrote: > Another bunch of Security alerts, degrades FreeBSD by being clumped together: > > I guess many recipients get tired of recent indigestable batches of > multiple FreeBSD Errata & think approx: I cannot recall whether you were participating in the discu

Batching errata & advisories in heaps degrades security.

2016-05-05 Thread Julian H. Stacey
Another bunch of Security alerts, degrades FreeBSD by being clumped together: Subject: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-16:17.openssl Date: Wed, 4 May 2016 22:55:46 + (UTC) Subject: [FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-16:06.libc Date: Wed, 4

Re: FreeBSD Security Advisory FreeBSD-SA-16:16.ntp

2016-05-05 Thread Mark Felder
On Wed, May 4, 2016, at 04:25, Ian Smith wrote: > On Sat, 30 Apr 2016 14:27:17 +, Poul-Henning Kamp wrote: > > [..] > > > The best explanation of all this is John R. Vig's Quartz Tutorial > > which is freely available on the web - highly recommended: > > > >http://www.am1.us/Local_

Re: FreeBSD Security Advisory FreeBSD-SA-16:17.openssl

2016-05-05 Thread Mark Felder
On Wed, May 4, 2016, at 21:32, Mel Pilgrim wrote: > On 5/4/2016 3:55 PM, FreeBSD Security Advisories wrote: > > FreeBSD-SA-16:17.opensslSecurity > > Advisory > > The FreeBSD > > Project > > Something

Re: FreeBSD Security Advisory FreeBSD-SA-16:17.openssl

2016-05-05 Thread Nathan Reilly
> On 5 May 2016, at 12:56 PM, ga...@zahemszky.hu wrote: > > 2016-05-05 04:32 időpontban Mel Pilgrim ezt írta: >> On 5/4/2016 3:55 PM, FreeBSD Security Advisories wrote: >>> FreeBSD-SA-16:17.opensslSecurity >>> Advisory >>>

Re: FreeBSD Security Advisory FreeBSD-SA-16:17.openssl

2016-05-05 Thread Matthew Seaman
On 05/05/16 05:56, ga...@zahemszky.hu wrote: > 2016-05-05 04:32 időpontban Mel Pilgrim ezt írta: >> On 5/4/2016 3:55 PM, FreeBSD Security Advisories wrote: >>> FreeBSD-SA-16:17.opensslSecurity >>> Advisory >>>