freebsd security - Apr 2014 - FreeBSD's heartbleed response

First, please let me say that I understand that FreeBSD is a
volunteer project.  I know that most everyone is using donated
time and donated hardware.  You'll find some old email addresses
of mine in the ports collection, in fact, and it's in the spirit
of volunteering that I write today.

The Heartbleed vulnerability is probably the highest priority,
farthest-reaching vulnerability I've ever seen.  Yet nearly a day
later, FreeBSD remains unpatched.  There are many worried
sysadmins and other users in #freebsd and elsewhere wondering
what's going on and when their systems will be patched.  So far
all we have is an unofficial gist on github and some discussion
here (which most users don't see) with no further information.
More transparency is needed.

Given the above, I come with a request to help: how can the
userbase at large help with getting these sorts of fixes out more
quickly?  I and others have hardware and time we'd be glad to
donate if it would help resolve these sorts of critical issues
more quickly.

I'm sorry if I sound impatient.  I want to help, but don't know
how, so I'm asking here. 

-- 
Chris Nehren
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 923 bytes
Desc: not available
URL:
<http://lists.freebsd.org/pipermail/freebsd-security/attachments/20140408/56fca71a/attachment.sig>

While it may not be quite what you're looking for, ports contains
OpenSSL 1.0.1g.

On 4/8/2014 1:42 PM, Chris Nehren wrote:
> later, FreeBSD remains unpatched.  There are many worried
> sysadmins and other users in #freebsd and elsewhere wondering
> what's going on and when their systems will be patched.  So far
> all we have is an unofficial gist on github and some discussion
> here (which most users don't see) with no further information.
> More transparency is needed.
* The port was very quickly updated.
* Xin posted a working patch to the list for those who really wanted to 
apply it.
* I think it reasonable that code touching such a CRITICAL aspect of the 
OS be *well* reviewed before getting committed.  IIRC there was a quick 
fix to an openssl bug in the past that then had to be fixed again.
* What is stopping people who care about security from joining, or 
following this mailing list ?

	---Mike




-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/