Since this is a pretty serious issue I think we should keep one canonical question for heartbleed on 13.04, maybe this one?
In this way we can make it clear up front that they're pretty much in trouble anyway and point people to upgrade pages, etc.
People who choose a short-support-term version and then don't update ought to know the potential downfalls of that predicament already and be taking their own responsibility to watch security announcements. If they are not doing this, the responsibility to educate them does not fall to a site like AskUbuntu. It's not that these people are beyond help, but that it doesn't make sense for this site to be the ones reaching out to help them. AskUbuntu is not a site for disseminating public notices about security issues - it's for answering people's questions about Ubuntu.
The site has an established and quite reasonable policy to consider questions specific to an older, unsupported version of Ubuntu as "off topic". This is a sensible and appropriate policy, and it does not just serve to keep content relevant but also to reinforce the idea that these versions of Ubuntu truly are "unsupported" - no matter what the question, the answer to a problem in an unsupported version is basically "have you considered upgrading?".
To break this policy in order to spread the word about one particular security flaw would be inconsistent and set up an ambiguous precedent, sending a mixed message where it's OK to help people out with their unsupported installs if the issue is "important".
So, what is an alternative solution?
If a question (whether it is about Heartbleed, or anything else) is specific to 13.04 then it should be closed with a message directing people to a big "why you should not be using this version and how you should upgrade" wiki page. If we want to help people get off vulnerable versions, that wiki page can be their lifeline and the limit to the support we want to give them.
No cherry-picking which issues are or are not "important" enough to break our policy on supporting retired versions of Ubuntu.
Why? I mean, we are advocates that people worrying about security issues, should use supported version of Ubuntu, since they aren't being totally patched. There are several CVEs that were fixed in supported versions that will not see the light in 13.04. If you are that worried about it, maybe it's time to upgrade your stuff, actually, what were you doing this previous 3 months?
XKCD workflow comic http://imgs.xkcd.com/comics/workflow.png
I know there are people on production that couldn't upgrade their system, but that means that we should patch around just to make them fit? What about 11.04, or 6.10, or Mint? If we aren't coherent with ourselves, we will end confusing users and the help center will be some dead bits without value.
We already have a one size fits all question for this stuff. Leaving this one open will just open the door to other questions. Just follow our help center.
I agree with Jorge. When it comes to a security breach with these gigantic consequences we should put our rules aside and make sure that people know
People will search for 13.04 and Heartbleed and it is better for them to find a sensible page than a locked one without a quality answer. I voted to reopen.
Additional argument: the current answer is incomplete (it does not explain that the certificates need to be regenerated [note: at the time of writing this]) and did not get any votes.
PS/ Maybe one of the seniors can provide a good answer to the question?
While I agree in principle with upgrading the current version of Ubuntu, the practicalities of our environment and technical resource allocation mean that we can not until the summer. I think this bug is serious enough given all the press attention that it warrants an answer. If nothing else, I can point my boss at and say, "see, see what the technical community is saying."
I also think you can pass a reasonableness test, and say that Ubuntu 13.04 is new enough that it should warrant some minor attention, as it is only just about a year old, whereas 11.04, and 6.04 are plainly antique, and Mint is out of scope.
As for the comment "What have they been doing for the last 3 months?" Well, I have been opening a new branch office, getting a MS Exchange 2010 migration project underway, upgrading a Citrix environment to name but three projects we're working on. Migrating an internal facing intranet application stack on Drupal, and Mediawiki with the full screen editor, and parsoid will have to wait until the summer.
I suppose some really do not have a clue what it is like to work in an under resourced IT department where management effectively thinks that IT still is a bunch of expensive toys.
