14

Since this is a pretty serious issue I think we should keep one canonical question for heartbleed on 13.04, maybe this one?

In this way we can make it clear up front that they're pretty much in trouble anyway and point people to upgrade pages, etc.

| |
  • 10
    13.04 is itself bad for the internet. I'm not against keeping one around pegged up (like a head at the gates) but before anything else the answer needs to highlight the scale of the issue of support. – Oli Apr 10 '14 at 19:20
  • 3
    Let me get this straight, this is about having a specific question kept open addressing what to do about the Heartbleed bug on Ubuntu 13.04, an unsupported version of Ubuntu? If there were ever a reason to stick steadfastly to our "you should not be running unsupported versions", it's at times like this. I don't think we should even validate the idea of running unsupported versions at all, it will normalise it. Heartbleed is the least of their troubles. – thomasrutter Apr 17 '14 at 4:24
9
  • It's not as if the support period for 13.04 was sprung onto people unexpectedly - it was set out in advance of release.
  • And it's not as if there's no alternative for those needing a longer support period - there's always an LTS or two to choose from.

People who choose a short-support-term version and then don't update ought to know the potential downfalls of that predicament already and be taking their own responsibility to watch security announcements. If they are not doing this, the responsibility to educate them does not fall to a site like AskUbuntu. It's not that these people are beyond help, but that it doesn't make sense for this site to be the ones reaching out to help them. AskUbuntu is not a site for disseminating public notices about security issues - it's for answering people's questions about Ubuntu.

The site has an established and quite reasonable policy to consider questions specific to an older, unsupported version of Ubuntu as "off topic". This is a sensible and appropriate policy, and it does not just serve to keep content relevant but also to reinforce the idea that these versions of Ubuntu truly are "unsupported" - no matter what the question, the answer to a problem in an unsupported version is basically "have you considered upgrading?".

To break this policy in order to spread the word about one particular security flaw would be inconsistent and set up an ambiguous precedent, sending a mixed message where it's OK to help people out with their unsupported installs if the issue is "important".

So, what is an alternative solution?

If a question (whether it is about Heartbleed, or anything else) is specific to 13.04 then it should be closed with a message directing people to a big "why you should not be using this version and how you should upgrade" wiki page. If we want to help people get off vulnerable versions, that wiki page can be their lifeline and the limit to the support we want to give them.

No cherry-picking which issues are or are not "important" enough to break our policy on supporting retired versions of Ubuntu.

| |
  • I like your approach and especially the " it should be closed with a message directing people to a big "why you should not be using this version and how you should upgrade" wiki page". Have an upvote. – don.joey Apr 18 '14 at 10:08
7

Why? I mean, we are advocates that people worrying about security issues, should use supported version of Ubuntu, since they aren't being totally patched. There are several CVEs that were fixed in supported versions that will not see the light in 13.04. If you are that worried about it, maybe it's time to upgrade your stuff, actually, what were you doing this previous 3 months?

XKCD workflow comic http://imgs.xkcd.com/comics/workflow.png

I know there are people on production that couldn't upgrade their system, but that means that we should patch around just to make them fit? What about 11.04, or 6.10, or Mint? If we aren't coherent with ourselves, we will end confusing users and the help center will be some dead bits without value.

We already have a one size fits all question for this stuff. Leaving this one open will just open the door to other questions. Just follow our help center.

| |
  • 3
    You're right, this is exactly why we need a question explaining that. – Jorge Castro Apr 10 '14 at 18:12
  • 1
    We need and answer in the main question explaining, not another question. it isn't going to help if they see nothing about 13.04 in the most popular question - just to try and ask "another 13.04 question" about the same subject. – Mateo Apr 10 '14 at 19:19
  • 1
    @Mateo The problem and answer is significantly different for unsupported releases though. An answer that spends 10 minutes enumerating the horrors of continuing to use an unsupported release before grudgingly telling you how to upgrade seems like the right balance between convenience and public safety. – Oli Apr 10 '14 at 19:31
  • 3
    don't forget adding credits for images you add to your post. xkcd comics deserve some credits. – Igor Milla Apr 14 '14 at 13:28
  • 1
    @igormilla it's hot linked to the XKCD servers. It would be a different history if I reuploaded it. – Braiam Apr 14 '14 at 16:05
4

I agree with Jorge. When it comes to a security breach with these gigantic consequences we should put our rules aside and make sure that people know

  • they should upgrade
  • how they should deal with HB before they find the time to upgrade.

People will search for 13.04 and Heartbleed and it is better for them to find a sensible page than a locked one without a quality answer. I voted to reopen.

Additional argument: the current answer is incomplete (it does not explain that the certificates need to be regenerated [note: at the time of writing this]) and did not get any votes.

PS/ Maybe one of the seniors can provide a good answer to the question?

| |
  • OK, then we should enable everybody to keep their system insecure? That's where the rules shine. – Braiam Apr 14 '14 at 16:08
  • 2
    Hi @Braiam I think you are missing the point. I don't want to change the rules, I just think we need to weigh our goals and our rules: our goal is to be the best informative QA website for Ubuntu; our rules are there to avoid that we spend too much time on unwanted questions. Here, for me, our goal is more important than the rule, viz. we want to provide good information. The fact that people should upgrade has to be part of the info. At present the only answer on that Q is one that does not even mention the need to upgrade. Hence we should step up and fix it in order to meet our goal. – don.joey Apr 14 '14 at 16:16
  • Ok, but lets agree that that question is not a good fit for the site. – Braiam Apr 14 '14 at 16:39
  • @Braiam Agreed. – don.joey Apr 14 '14 at 17:09
2

While I agree in principle with upgrading the current version of Ubuntu, the practicalities of our environment and technical resource allocation mean that we can not until the summer. I think this bug is serious enough given all the press attention that it warrants an answer. If nothing else, I can point my boss at and say, "see, see what the technical community is saying."

I also think you can pass a reasonableness test, and say that Ubuntu 13.04 is new enough that it should warrant some minor attention, as it is only just about a year old, whereas 11.04, and 6.04 are plainly antique, and Mint is out of scope.

As for the comment "What have they been doing for the last 3 months?" Well, I have been opening a new branch office, getting a MS Exchange 2010 migration project underway, upgrading a Citrix environment to name but three projects we're working on. Migrating an internal facing intranet application stack on Drupal, and Mediawiki with the full screen editor, and parsoid will have to wait until the summer.

I suppose some really do not have a clue what it is like to work in an under resourced IT department where management effectively thinks that IT still is a bunch of expensive toys.

| |
  • 2
    If your server is not internet facing then you're probably fine. – Jorge Castro Apr 14 '14 at 14:48
  • I'm saying that one of the biggest reasons to keep yourself updated is security. Worrying about security while keeping non-supported release is irrational. BTW, this maybe is a comment to my answer, not an answer to the question itself. – Braiam Apr 14 '14 at 16:14
  • 1
    +1 for explaining to people that in a corporate environment "just upgrade it" isn't useful or reasonable advice. I work for a very large company, and just upgrading our production environment from RHEL4 to RHEL6 was a monumental coordinated effort which took months. – asteri Apr 17 '14 at 11:19
  • A server should always run a LTS version in my opinion, mainly if the admin has not much time to admin it. Today, Lucid (10.04) is still supported and of course Precise (12.04) also. That gives a lot of time to upgrade... Choosing a 6 months release is not very wise for a server hard to update. Most of them can update almost alone if they are not full of "local fixes" ;). I only had problems once with ldap servers from 10.04 to 12.04 until now (because of the cryptography lib incompatibilities). – laurent Apr 19 '14 at 1:20
  • In corporate environment with lot of servers and critical ones, the unreasonable part lies in choosing a short life version for a server I think, not in having to upgrade when it has reached EOL. – laurent Apr 19 '14 at 1:24
  • Features that are in 13.04 and not in the LTS releases were required. – David Apr 20 '14 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .