I receive daily email from the host which normally shows port audits and vu= lnerabilities. However, I did not sport anything related to CVE-2014-0160 i= n this email. I expected the same info comes in this email about the base s= ystem as well. How do you normally inform about recent vulnerability in the base system? (= I believe newspaper and TV is not the best way...) Cheers B. ---------------------------------------- > Subject: Re: CVE-2014-0160? > From: [email protected] > Date: Fri, 11 Apr 2014 16:12:36 +0300 > To: [email protected] > CC: [email protected] > > > On 11.4.2014, at 15.53, [email protected] wrote: > >> ext 65281 (renegotiation info, length=3D1) >> ext 00011 (EC point formats, length=3D4) >> ext 00035 (session ticket, length=3D0) >> ext 00015 (heartbeat, length=3D1) <-- Your server supports heartbeat. Bu= g is possible when linking against OpenSSL 1.0.1f or older. Let me check. >> Actively checking if CVE-2014-0160 works: Your server appears to be patc= hed against this bug. >> >> K=F6sz! ;-) >> >> Is there any reason why nightly security patches are not enabled by defa= ult in FreeBSD? >> >> >> Cheers >> B. >> > > Why do you make such claim? The security patches are very much =93enabled= =94 (by using your words) in FreeBSD by default. This assuming that you are= in fact aware of the update methods that are available and how they work. = And for the update methods and how they work there=92s a tremendous amount = of information out there, even translated to your native language in some c= ases if the language barrier is a problem for you. > > -Kimmo = _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"