[CentOS] [security] Thunderbird vulnerable to MITM

[Always Learning]

On Sun, 2015-08-23 at 07:57 -0700, Alice Wonder wrote:


> I stopped using Fedora because as soon as it was stable it was end of 
> life and I was forced to install a new bleeding edge unstable version.

I am 'conservative' too. Once something is working well I do not wish to
change it unless there is a compelling conspicuous advantage.

> I do not like bleeding edge for most things, I use mate in CentOS 
> because GNOME 3 is not to my liking, for example, and makes me feel like 
> I am fighting the desktop instead of using the desktop.

Bleeding edge inevitable means 'bugs' and, potentially, data loss and/or
paralysed systems. Fortunately I have yet to encounter any of the
delights of C7 as C5 and C6 fulfil my needs.

> I do not know if LibreSSL will ever be part of Fedora or CentOS because 
> FIPS support is not one of the goals of the projects, but FIPS didn't 
> protect anyone from the several OpenSSL vulnerabilities that led to 
> LibreSSL so FIPS is not a concern of mine, but it is a requirement for 
> some places so I suspect it will be difficult for it to enter the Red 
> Hat ecosystem.
> 
> RHEL packages need to build against OpenSSL to have FIPS and so Fedora 
> packages will continue to build against OpenSSL. Politics sucks.

Yes some people's version of politics is annoying. Politics ought to be
about creating pragmatic solutions for the public good rather than
enforcing brain-dead dogma.

MariaDB is a so-called "drop-in" replacement for MySQL although I
understand version 10 is not compatible.

Could LibreSSL create a "drop-in" replacement version for OpenSSL ?


-- 
Regards,

Paul.
England, EU.      England's place is in the European Union.