R help - May 2024 - Current version of R, 4.4.0 and patch to correct the bug fix related to the RStudio viewer pane on Windows systems

I help to coordinate the USEPA's R user group.  We have over 500 members and
our security officer has required us to update to R version 4.4.0 because of the
security vulnerability to versions prior.  However, we cannot download the
patched version because it does not have a signed certificate and Microsoft
Defender won't allow us to install it.

Most of our users rely on the RStudio viewer pane so we are in a bit of a
quandary.  We suspect other government agencies are impacted by this as well.

Can you give me an estimated time for when another official version will be
released with the patch included?  I may be able to ask our security officer to
allow us to delay our install until that official version is released. 
Alternatively, if the patched version could have a signed certificate, that
would allow us to install it.

Thank you.

Ann Vega, PSPO
She/Her/Hers (Learn
More<https://intranet.ord.epa.gov/dei/gender-pronouns>)
Office of Science Information Management, Data Architect
EPA Office of Research and Development
Cincinnati, OH

Mobile: 513-418-1922 - or reach out to me on Teams!
Hours:  Monday-Thursday, 7:30am - 6:00 pm, CDO:  Fridays
Email: vega.ann at epa.gov<mailto:vega.ann at epa.gov>



	[[alternative HTML version deleted]]

The developer.r-project.org site lists plans for releases, and no plan 
is in place yet for a 4.4.1 release.

You can look at the history of previous versions if you want to make a 
guess:

4.3.1: June, 2023
4.2.1: June, 2022
4.1.1: August, 2021
4.0.1: June, 2020
3.6.1: July, 2019
3.5.1: July, 2018
3.4.1: June, 2017
3.3.1: June, 2016

So it's a good guess that it will happen before September, and better 
than even odds it will be before July.

Duncan Murdoch

On 2024-05-16 7:39 a.m., Vega, Ann (she/her/hers) via R-help
wrote:
> I help to coordinate the USEPA's R user group.  We have over 500
members and our security officer has required us to update to R version 4.4.0
because of the security vulnerability to versions prior.  However, we cannot
download the patched version because it does not have a signed certificate and
Microsoft Defender won't allow us to install it.
> 
> Most of our users rely on the RStudio viewer pane so we are in a bit of a
quandary.  We suspect other government agencies are impacted by this as well.
> 
> Can you give me an estimated time for when another official version will be
released with the patch included?  I may be able to ask our security officer to
allow us to delay our install until that official version is released. 
Alternatively, if the patched version could have a signed certificate, that
would allow us to install it.
> 
> Thank you.
> 
> Ann Vega, PSPO
> She/Her/Hers (Learn
More<https://intranet.ord.epa.gov/dei/gender-pronouns>)
> Office of Science Information Management, Data Architect
> EPA Office of Research and Development
> Cincinnati, OH
> 
> Mobile: 513-418-1922 - or reach out to me on Teams!
> Hours:  Monday-Thursday, 7:30am - 6:00 pm, CDO:  Fridays
> Email: vega.ann at epa.gov<mailto:vega.ann at epa.gov>
> 
> 
> 
> 	[[alternative HTML version deleted]]
> 
> ______________________________________________
> R-help at r-project.org mailing list -- To UNSUBSCRIBE and more, see
> https://stat.ethz.ch/mailman/listinfo/r-help
> PLEASE do read the posting guide
http://www.R-project.org/posting-guide.html
> and provide commented, minimal, self-contained, reproducible code.

Do you receive RDS objects from unknown (untrusted) sources?

?? If not - the security issue is a non-issue as I understand it.


On Thu, 16 May 2024, 16:21 Vega, Ann (she/her/hers) via R-help, <
r-help at r-project.org> wrote:
> I help to coordinate the USEPA's R user group.  We have over 500
members
> and our security officer has required us to update to R version 4.4.0
> because of the security vulnerability to versions prior.  However, we
> cannot download the patched version because it does not have a signed
> certificate and Microsoft Defender won't allow us to install it.
>
> Most of our users rely on the RStudio viewer pane so we are in a bit of a
> quandary.  We suspect other government agencies are impacted by this as
> well.
>
> Can you give me an estimated time for when another official version will
> be released with the patch included?  I may be able to ask our security
> officer to allow us to delay our install until that official version is
> released.  Alternatively, if the patched version could have a signed
> certificate, that would allow us to install it.
>
> Thank you.
>
> Ann Vega, PSPO
> She/Her/Hers (Learn
More<https://intranet.ord.epa.gov/dei/gender-pronouns
> >)
> Office of Science Information Management, Data Architect
> EPA Office of Research and Development
> Cincinnati, OH
>
> Mobile: 513-418-1922 - or reach out to me on Teams!
> Hours:  Monday-Thursday, 7:30am - 6:00 pm, CDO:  Fridays
> Email: vega.ann at epa.gov<mailto:vega.ann at epa.gov>
>
>
>
>         [[alternative HTML version deleted]]
>
> ______________________________________________
> R-help at r-project.org mailing list -- To UNSUBSCRIBE and more, see
> https://stat.ethz.ch/mailman/listinfo/r-help
> PLEASE do read the posting guide
> http://www.R-project.org/posting-guide.html
> and provide commented, minimal, self-contained, reproducible code.
>
	[[alternative HTML version deleted]]