14

Since this is a pretty serious issue I think we should keep one canonical question for heartbleed on 13.04, maybe this one?

In this way we can make it clear up front that they're pretty much in trouble anyway and point people to upgrade pages, etc.

2
  • 10
    13.04 is itself bad for the internet. I'm not against keeping one around pegged up (like a head at the gates) but before anything else the answer needs to highlight the scale of the issue of support.
    – Oli Mod
    Apr 10, 2014 at 19:20
  • 3
    Let me get this straight, this is about having a specific question kept open addressing what to do about the Heartbleed bug on Ubuntu 13.04, an unsupported version of Ubuntu? If there were ever a reason to stick steadfastly to our "you should not be running unsupported versions", it's at times like this. I don't think we should even validate the idea of running unsupported versions at all, it will normalise it. Heartbleed is the least of their troubles. Apr 17, 2014 at 4:24

4 Answers 4

9
  • It's not as if the support period for 13.04 was sprung onto people unexpectedly - it was set out in advance of release.
  • And it's not as if there's no alternative for those needing a longer support period - there's always an LTS or two to choose from.

People who choose a short-support-term version and then don't update ought to know the potential downfalls of that predicament already and be taking their own responsibility to watch security announcements. If they are not doing this, the responsibility to educate them does not fall to a site like AskUbuntu. It's not that these people are beyond help, but that it doesn't make sense for this site to be the ones reaching out to help them. AskUbuntu is not a site for disseminating public notices about security issues - it's for answering people's questions about Ubuntu.

The site has an established and quite reasonable policy to consider questions specific to an older, unsupported version of Ubuntu as "off topic". This is a sensible and appropriate policy, and it does not just serve to keep content relevant but also to reinforce the idea that these versions of Ubuntu truly are "unsupported" - no matter what the question, the answer to a problem in an unsupported version is basically "have you considered upgrading?".

To break this policy in order to spread the word about one particular security flaw would be inconsistent and set up an ambiguous precedent, sending a mixed message where it's OK to help people out with their unsupported installs if the issue is "important".

So, what is an alternative solution?

If a question (whether it is about Heartbleed, or anything else) is specific to 13.04 then it should be closed with a message directing people to a big "why you should not be using this version and how you should upgrade" wiki page. If we want to help people get off vulnerable versions, that wiki page can be their lifeline and the limit to the support we want to give them.

No cherry-picking which issues are or are not "important" enough to break our policy on supporting retired versions of Ubuntu.

1
  • I like your approach and especially the " it should be closed with a message directing people to a big "why you should not be using this version and how you should upgrade" wiki page". Have an upvote.
    – don.joey
    Apr 18, 2014 at 10:08
7

Why? I mean, we are advocates that people worrying about security issues, should use supported version of Ubuntu, since they aren't being totally patched. There are several CVEs that were fixed in supported versions that will not see the light in 13.04. If you are that worried about it, maybe it's time to upgrade your stuff, actually, what were you doing this previous 3 months?

XKCD workflow comic http://imgs.xkcd.com/comics/workflow.png

I know there are people on production that couldn't upgrade their system, but that means that we should patch around just to make them fit? What about 11.04, or 6.10, or Mint? If we aren't coherent with ourselves, we will end confusing users and the help center will be some dead bits without value.

We already have a one size fits all question for this stuff. Leaving this one open will just open the door to other questions. Just follow our help center.

5
  • 3
    You're right, this is exactly why we need a question explaining that. Apr 10, 2014 at 18:12
  • 1
    We need and answer in the main question explaining, not another question. it isn't going to help if they see nothing about 13.04 in the most popular question - just to try and ask "another 13.04 question" about the same subject.
    – Mateo
    Apr 10, 2014 at 19:19
  • 1
    @Mateo The problem and answer is significantly different for unsupported releases though. An answer that spends 10 minutes enumerating the horrors of continuing to use an unsupported release before grudgingly telling you how to upgrade seems like the right balance between convenience and public safety.
    – Oli Mod
    Apr 10, 2014 at 19:31
  • 3
    don't forget adding credits for images you add to your post. xkcd comics deserve some credits.
    – Igor Milla
    Apr 14, 2014 at 13:28
  • 1
    @igormilla it's hot linked to the XKCD servers. It would be a different history if I reuploaded it.
    – Braiam
    Apr 14, 2014 at 16:05
4

I agree with Jorge. When it comes to a security breach with these gigantic consequences we should put our rules aside and make sure that people know

  • they should upgrade
  • how they should deal with HB before they find the time to upgrade.

People will search for 13.04 and Heartbleed and it is better for them to find a sensible page than a locked one without a quality answer. I voted to reopen.

Additional argument: the current answer is incomplete (it does not explain that the certificates need to be regenerated [note: at the time of writing this]) and did not get any votes.

PS/ Maybe one of the seniors can provide a good answer to the question?

4
  • OK, then we should enable everybody to keep their system insecure? That's where the rules shine.
    – Braiam
    Apr 14, 2014 at 16:08
  • 2
    Hi @Braiam I think you are missing the point. I don't want to change the rules, I just think we need to weigh our goals and our rules: our goal is to be the best informative QA website for Ubuntu; our rules are there to avoid that we spend too much time on unwanted questions. Here, for me, our goal is more important than the rule, viz. we want to provide good information. The fact that people should upgrade has to be part of the info. At present the only answer on that Q is one that does not even mention the need to upgrade. Hence we should step up and fix it in order to meet our goal.
    – don.joey
    Apr 14, 2014 at 16:16
  • Ok, but lets agree that that question is not a good fit for the site.
    – Braiam
    Apr 14, 2014 at 16:39
  • @Braiam Agreed.
    – don.joey
    Apr 14, 2014 at 17:09
2

While I agree in principle with upgrading the current version of Ubuntu, the practicalities of our environment and technical resource allocation mean that we can not until the summer. I think this bug is serious enough given all the press attention that it warrants an answer. If nothing else, I can point my boss at and say, "see, see what the technical community is saying."

I also think you can pass a reasonableness test, and say that Ubuntu 13.04 is new enough that it should warrant some minor attention, as it is only just about a year old, whereas 11.04, and 6.04 are plainly antique, and Mint is out of scope.

As for the comment "What have they been doing for the last 3 months?" Well, I have been opening a new branch office, getting a MS Exchange 2010 migration project underway, upgrading a Citrix environment to name but three projects we're working on. Migrating an internal facing intranet application stack on Drupal, and Mediawiki with the full screen editor, and parsoid will have to wait until the summer.

I suppose some really do not have a clue what it is like to work in an under resourced IT department where management effectively thinks that IT still is a bunch of expensive toys.

6
  • 2
    If your server is not internet facing then you're probably fine. Apr 14, 2014 at 14:48
  • I'm saying that one of the biggest reasons to keep yourself updated is security. Worrying about security while keeping non-supported release is irrational. BTW, this maybe is a comment to my answer, not an answer to the question itself.
    – Braiam
    Apr 14, 2014 at 16:14
  • 1
    +1 for explaining to people that in a corporate environment "just upgrade it" isn't useful or reasonable advice. I work for a very large company, and just upgrading our production environment from RHEL4 to RHEL6 was a monumental coordinated effort which took months.
    – asteri
    Apr 17, 2014 at 11:19
  • A server should always run a LTS version in my opinion, mainly if the admin has not much time to admin it. Today, Lucid (10.04) is still supported and of course Precise (12.04) also. That gives a lot of time to upgrade... Choosing a 6 months release is not very wise for a server hard to update. Most of them can update almost alone if they are not full of "local fixes" ;). I only had problems once with ldap servers from 10.04 to 12.04 until now (because of the cryptography lib incompatibilities).
    – laurent
    Apr 19, 2014 at 1:20
  • In corporate environment with lot of servers and critical ones, the unreasonable part lies in choosing a short life version for a server I think, not in having to upgrade when it has reached EOL.
    – laurent
    Apr 19, 2014 at 1:24
  • Features that are in 13.04 and not in the LTS releases were required.
    – David
    Apr 20, 2014 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .