Heartbleed in murga-linux.com?

[mavrothal]

Though everybody is wondering if puppy is affected by the HeartBleed openSSL bug (even if puppy is not the most likely OS for a server ) I was rather wondering if murga-linux.com was vulnerable to the bug.
Test sites showing it as fine now and I guess is not a major site to make the lists, but should we be changing passwords fast or not?

[dejan555]

considering that forum is running ancient phpbb version I doubt openssl is being bumped to newer versions with bug included either.
But maybe server management is not managed by John but some hosting company. In that case he should mail them.

[ThoriumBlvd]

IIRC GoDaddy is either the server-host or the domain-holder. Good luck with that.

[Flash]

Website security is the responsibility of our website administrator, John Murga, not our host, whoever that is. As dejan555 pointed out, our website software is so old that it could not contain the ssl "enhancement" that introduced the Heartbleed flaw.

[Semme]

As I've never seen an encrypted page here, I doubt murga-linux even supports ssl over http.

Code: Select all

echo ^D | telnet www.murga-linux.com https

And if it does.. WHOOP-DEE-DOO!

http://www.networking4all.com/en/suppor ... ocol=https

https://www.sslshopper.com/ssl-checker. ... -linux.com

[mavrothal]

As dejan555 pointed out, our website software is so old that it could not contain the ssl "enhancement" that introduced the Heartbleed flaw.

The fact that php is old does not necessarily means that the OS is old too, but as correctly pointed out there are no https here. So all the passwords can be sniffed out but at least we are safe from heardbleed

[slavvo67]

So what you're saying is it's good to be old! Hoorah!

[dejan555]

So all the passwords can be sniffed out but at least we are safe from heardbleed

Yeah, logging to forum works even from dillo xD

[mikeb]

Dropbox has messed up my use of curl to access it as it's changed its ssl system because of this.
The point is are there any other puppy related sites using https that might affect such as package managers, quickpet, flash updaters etc etc?

mike

[jamesbond]

The fact that php is old does not necessarily means that the OS is old too, but as correctly pointed out there are no https here. So all the passwords can be sniffed out but at least we are safe from heardbleed

Now that's different. This forum doesn't use http so we can expect anybody to sniff our passwords just like that. But those https sites come with *expectation* that they are secure. The fact that they are *not*

[nooby]

John told us some years ??? ago that he choose
the old version to avoid some vulnerability.

But I am too much noob to not get such things.

But I do remember him made it a choice and
he did see some merit doing it that way.