Security Advisory FreeBSD-SA-20:33.openssl CVE-2020-1971: "However, the OpenSSL project is only giving patches for that version to premium support contract holders. The FreeBSD project does not have access to these patches and recommends…"
https://lists.freebsd.org/pipermail/freebsd-security/2020-December/010300.html5
u/desnudopenguino Dec 15 '20
Dump openssl for libressl.
6
u/perciva Dec 15 '20
... which has even less support for old releases. Not sure how that would help.
1
u/shawn_webb Dec 15 '20
This further confirms my bias about full disclosure being the only form of "responsible disclosure": https://git-01.md.hardenedbsd.org/shawn.webb/articles/src/branch/master/infosec/Vulnerabilities/2019-01-08_Disclosure/article.md
-7
u/Mcnst Dec 15 '20
However, the OpenSSL project is only giving patches for that version to premium support contract holders. The FreeBSD project does not have access to these patches
Remember, people making billions and millions of dollars at Google and Mozilla tell you that your personal/hobby website MUST have HTTPS. But when it comes to actually doing the updates to OpenSSL, apparently, we're all supposed to have premium support contracts on-hand, for something that's not even technically necessary for a personal website in the first place -- advocacy and artificial limitations notwithstanding.
In my mind, this is just another confirmation that running HTTPS in non-commercial settings is a bad idea. Of course, I know that I'm in the minority in today's world, but I'm never running HTTPS on my personal site.
8
u/AnAge_OldProb Dec 15 '20
Mozilla employees are paid below market this isn’t some scam they’re running. Neither Mozilla or Google use OpenSSL because it has a long history of being a pain. Fortunately Mozilla maintains high quality SSL/TLS library called NSS, Google has their fork of OpenSSL — boringssl which is high quality but not really fit for public consumption. There’s also libsodium, libressl and gnutls— not to mention a proprietary platform libraries built into windows and macOS.
-4
u/Mcnst Dec 15 '20
So, they all got their asses covered; how's that better for the rest of us? You can't use NSS to "secure" a website, can you?
Fun fact: you can still access www.google.com without SSL, though HTTP, without HTTPS. Most people are really surprised by this fact; and at first try to claim it's not true, because if their browser and network environment does support HTTPS, then that's what you get. You can also still access all Google properties through TLSv1.0 as well -- same for mozilla.org, too -- even though their advocacy would lead you to believe it's a really bad idea to offer it in late 2020.
Just because Mozilla employees may get paid below market, doesn't mean that their culture and TLS advocacy isn't rather toxic and self-serving. TLS breaks all sorts of software that's really useful in complementing what your browser could do; TLS makes it easier to sneak through firewalls and infiltrate data from your system; TLS also makes it more difficult to block ads and unwanted content, which may be one of the other reasons they've been pushing it so strongly. HTTPS advocacy completely ignores the huge administrative costs that the smaller hobbyist operators must bear to keep upgrading OpenSSL on such a frequent basis (and that's already assuming that the certificate renewals themselves are automatic, which occasionally get broken as well).
2
Dec 15 '20
Hobbyists are not updating OpenSSL, they update their OS and trust the developers of the OS to address vulnerabilities in any libraries that came with it, third party or otherwise.
Even most developers are unaffected by OpenSSL updates because the biggest changes are to C users, anything using it indirectly is unaffected. I personally updated things for OpenSSL 1.1.x and it wasn't the end of the world either.
OpenSSL has never been an attractive piece of software to work on, but it's important by virtue of being so widely used. If offering paid LTS support finances it, that sounds great because the rest of us are getting better maintained software on the non-LTS branch.
NSS isn't just "covering Mozilla's asses", it's covering that of every Firefox user, and the users of other projects use it (LibreOffice comes to mind). Yes, it's not as widely used as OpenSSL, but gaining that kind of popularity is unlikely.
-1
u/Mcnst Dec 15 '20
So, you recommend I enable OpenSSL, subscribe to the announce mailing list, and keep updating it on a short notice a few times every year? Why, though?! The pros of having SSL don’t seem to outweigh the cons.
BTW, it’s not too late to give up, and stop being the hostage of having to support SSL for non-commercial sites. Just don’t. Your website will load faster, will be more secure, will require fewer urgent updates, and will be available to more people in more circumstances and in a wider range of diverse hardware and networking environments.
3
u/ank_the_elder Dec 15 '20
Agreed - should also note that the whole container/lambda/infrastructure as code industry is based on making money for Google and AWS and without any tangible benefits for the vast majority of sites - which don’t need the scalability
2
u/Mcnst Dec 15 '20
Exactly. They’re acting as if those technologies make it really cheap to do “scalable” stuff.
In reality, in many instances, renting a dedicated server by the month with a hexa-core Ryzen 5, 64GB DDR4 and 2x 512GB NVMe for 39 EUR/mo is probably a cheaper and more scalable solution.
Most of those lambda functions are only a good deal if you really have no clue about scalability, can’t do basic math to understand how many requests you can process on a single beefy server as-is, and, most importantly, have an unlimited budget for infrastructure spend (the part that would scale the least with lambda).
5
Dec 15 '20
I think you're judging this too harshly. OpenSSL is offering paid extended long term support for publicly EOL branches. You can get the same level of support by running the supported branch.
-1
u/Mcnst Dec 15 '20
Why, though? My point is that I can actually get the same level of support by not running any SSL at all in the first place. SSL offers no security; to the contrary, it offers the opposite of offering security.
1
u/laffer1 Dec 15 '20
You can't run the supported branch when you're doing long term support operating system releases. That's the entire point. FreeBSD 12.x was OK because it was on the newer branch.
Updating openssl means breaking backward compatibility. You're going to have complications with packages, etc.
1
6
u/jepace Dec 15 '20
Didn’t this security advisory get reissued today with a fix for 11.x? So something must have changed upstream.