Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debian 6.0 “Squeeze” released

debian.org

Post reply on HN
Print view View original

31–40 of 47 posts

Re: Debian 6.0 “Squeeze” released

#31

Post by dpapathanasiou »

moe wrote: post #29
dpapathanasiou wrote: post #28

Earlier quoted context omitted.

PCI compliance audits require at least v. 1.0.0 of OpenSSL.

Interesting, I didn't know that. Seems like a flaw in the PCI requirements to me, do they really demand the "latest" version instead of the stable, time-tested one? It certainly can't be in the spirit of these audits to encourage people to move from Debian stable to a distro that's based on Debian unstable ...

Well, their solution was to build OpenSSL 1.0.0 (which is stable) from source.

That was easy, but then rebuilding other components which were linked to the original v. 0.9.x was a major PITA.

This is the problem, according to the auditor:

Vulnerability in OpenSSL 0.9.8g Severity: Critical Problem CVE: CVE2008-0891 CVE-2008-1672 CVE-2008-5077 CVE-2009-0590 CVE-2009-0789 CVE-20091377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1386 CVE-2009-3245 CVE-2009-3555 CVE-2010-0433 CVE-2010-0740 Impact: A remote attacker could execute arbitrary commands , cause a buffer overflow, bypass security or create a denial of service. Resolution OpenSSL shouldbe [http://www.openssl.org/source/] upgraded to 1.0.0a or higher.

Those CVE ("Common Vulnerabilities and Exposures") items are explained in more detail at NIST: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-089... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-137... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-074... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-043... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-324...

Re: Debian 6.0 “Squeeze” released

#32

Post by moe »

dpapathanasiou wrote: post #31
moe wrote: post #29

Earlier quoted context omitted.

Interesting, I didn't know that. Seems like a flaw in the PCI requirements to me, do they really demand the "latest" version instead of the stable, time-tested one? It certainly can't be in the spirit of these audits to encourage people to move from Debian stable to a distro that's based on Debian unstable ...

Well, their solution was to build OpenSSL 1.0.0 (which is stable) from source. That was easy, but then rebuilding other components which were linked to the original v. 0.9.x was a major PITA. This is the problem, according to the auditor: Vulnerability in OpenSSL 0.9.8g Severity: Critical Problem CVE: CVE2008-0891 CVE-2008-1672 CVE-2008-5077 CVE-2009-0590 CVE-2009-0789 CVE-20091377 CVE-2009-1378 CVE-2009-1379 CVE-200…

Well, this ignores the reality of how most linux distributions are maintained.

Version numbers are not supposed to change after the fact in a stable-release, hence security fixes get backported (every distro has a security-team for this).

If PCI requires a less tested newer version over a battle-scarred (patched up) older one then PCI is working against its own stated goal.

It doesn't take much wisdom to realize that it's less likely for new bugs to crop up in the 0.9.8 openssl that Debian ships than in the 1.0.0c that RHEL6 bundles (just one month after release!).

New software has bugs. Old software has less bugs.

Re: Debian 6.0 “Squeeze” released

#33

Post by Supermighty »

srean wrote: post #12

Debian and Arch are my two favorite Linux distributions. If only Debian distributed a version compiled for an i686 also. I know it probably wont make a huge difference for most programs. But it niggles at my sensibilities that I am not using the architecture to its full. Arch is pretty awesome in that field, but I would be wary of running it on production servers. For me Debian testing has been the best compromise, a…

Debian and Arch are my favorite too. I just wish Debian had a bit shorter release cycle. But it's a trade off, longer release cycle == stable release.

I use Arch on my workstations. They don't need as stable a platform as my server. And any downtime would be minimal and easy to schedule around.

Re: Debian 6.0 “Squeeze” released

#34

Post by lreeves »

dpapathanasiou wrote: post #28
moe wrote: post #8

Earlier quoted context omitted.

Out of curiosity, which feature from 1.2.2 do you need that 0.9.8 doesn't have?

PCI compliance audits require at least v. 1.0.0 of OpenSSL.

You should have explained to your auditor that Debian backports security patches to the shipped version of OpenSSL.

Re: Debian 6.0 “Squeeze” released

#36

Post by augustl »

angrycoder wrote: post #4

Anyone know if these images work with any of the popular USB key installers?

Of the distros I have used, only Ubuntu ships images that only boots on CDs. Debian, Arch, OpenSUSE all ship images that boot on "normal" storage (such as USB sticks, HDs, SSDs) and can be DD-ed to them.

Re: Debian 6.0 “Squeeze” released

#37

Post by squeezingswirls »

BCM43 wrote: post #21
squeezingswirls wrote: post #3

Debian 6.0 (Squeeze) has been released! http://cdimage.debian.org/debian-cd/6.0.0/ Use torrents for download the isos, please. You can find the seeds under every architecture in the directories beginning with bt- For instance: http://cdimage.debian.org/debian-cd/6.0.0/amd64/bt-cd/ And keep seeding ’til you’re bleeding ^_^ Edit to add this new Debian-installer page (within a brand new design site): http://www.debian.o…

Does your username have anything to do with Debian?

Nothing officially at all, I'm just a Debian user.

The nick is just a little game because I like to extract Debian's juice in my machines.

Re: Debian 6.0 “Squeeze” released

#38

Post by squeezingswirls »

rkuester wrote: post #24
telemachos wrote: post #19

Debian's website also received an upgrade[1]: > On the occasion of the release of Debian 6.0 Squeeze, the Debian website team is pleased to publish a new design for Debian's web presence. After roughly 13 years with nearly the same design, the layout and design of many of the websites run by Debian changed together with today's release of Debian Squeeze. Debian's main website and its wiki, lists archive, blog aggrega…

I don't have enough expertise in design to articulate why, but it seems to fall quite short of `cleaner and more modern.' Well, maybe it is a bit less '90s than the previous design, but I'd hardly call it clean and modern. The logo off to the left of the banner is odd, the different fonts and sizes aren't pleasing together, the columns of links seem like something you'd see at the bottom of a page rather than in the…

Debian is made by volunteers and sure here at HN are amazing web designers, so jump to Debian ship and help to make Debian project even greater.

Re: Debian 6.0 “Squeeze” released

#39

Post by preek »

$ apt-get clean; apt-get update; apt-get -u dist-upgrade

782 upgraded, 162 newly installed, 22 to remove.

Darn, all this terrible upgrading work in Debian. Sometimes I wish I had a real OS. Why can't we all just run WinXP - those guys _never_ have to upgrade and they still run the best OS on the planet!

Re: Debian 6.0 “Squeeze” released

#40

Post by anto1ne »

dpapathanasiou wrote: post #5
KaeseEs wrote: post #2

Good to see my favorite distro moving forward! I only wish they could have managed to ship Perl 5.12 rather than 5.10.

I love debian too, but I don't understand why they're so far behind. OpenSSL in squeeze is v. 0.9.8o-4? http://packages.debian.org/squeeze/openssl C'mon, guys, the latest current OpenSSL is already at v. 1.2.2 This is why I'm switching to ubuntu.

They're so far behind because they're dedicated to release only when they think it's bug-free enough (for all packages, including all dependencies), which can be long after they freeze versions and features.

Another thing is they release the same distrib version on 9 different architectures, not only i386/amd64.

Considering this, and the fact they're volunteers, I don't think they're that far behind.

Post reply on HN