Heartbleed - we are not affected

Updates on forum status, bug fixes, etc. If there's something new in here its probably a good idea that you read it.
Post Reply
User avatar
Quiff Boy
Herr Administrator
Posts: 16827
Joined: 25 Jan 2002, 00:00
Location: Lurking and fixing
Contact:
Contact Quiff Boy

There's been a lot in the press the last couple of days about a webserver security vulnerability known as Heartbleed.

You can read more about it here: http://heartbleed.com

A high number of high-profile websites have proven to be vulnerable, and users have been advised to change their passwords. There's a great list here:

http://mashable.com/2014/04/09/heartble ... -affected/

As you can see, sites and services like Amazon, Gmail etc have been affected.

The good news is that Heartland is not affected by this issue.

The way we handle user accounts & logins means this bug in older versions of SSL does not apply to us. The same applies to the SistersWiki.

Having said that, OpenSSL is installed on the Heartland webserver, but as of wednesday afternoon has been patched to the latest secure version.

In short, you do not need to change your Heartland password. :)

We would, however, recommend you change your passwords on the sites mentioned in that article above :urff:
What’s the difference between a buffalo and a bison?
Top
User avatar
Being645
Wiki Wizard
Posts: 15321
Joined: 09 Apr 2009, 12:54
Location: reconstruction status: whatever the f**k

You're perfect ... :notworthy: :notworthy: :notworthy: :notworthy: :notworthy: ... ;D ...
Top
User avatar
radiojamaica
Overbomber
Posts: 4875
Joined: 11 Apr 2005, 16:51
Location: Tower of Bass

Good one, Herr Quiffster :notworthy:
in dub we trust
Top
User avatar
Johnny Rev 7.0
Banned
Posts: 1134
Joined: 09 Sep 2006, 22:15
Location: A place I go where no one knows

Thanks very much Barry, and I'll endorse Bine's and Koen's comments above, for the sterling work you do behind the scenes to keep HL safe. :notworthy:

As you know, I'm not much of a geeky boy, and the Heartbleed thingy is kinda over my head, but I do have one question:

Can I still buy a cheap kitchen via Announcements on HL?

TIA. :kiss:
What a season
to be beautiful
without a reason
Top
User avatar
Pista
Cureboi
Posts: 17755
Joined: 25 Jun 2006, 15:03
Location: Lost In A Forest
Contact:
Contact Pista

Johnny Rev 7.0 wrote: Heartbleed thingy is kinda over my head, but I do have one question:

Can I still buy a cheap kitchen via Announcements on HL?

TIA. :kiss:
seems it's possible http://www.myheartland.co.uk/viewtopic.php?t=24093

Thanks for the update Barry.
It seems the entire interweb's in confusion over the amount of risk there is.
Glad you got a patch on.
:notworthy: :notworthy:
Cheers.
Steve
Just like the old days
TheCureCommunity
Top
User avatar
Johnny Rev 7.0
Banned
Posts: 1134
Joined: 09 Sep 2006, 22:15
Location: A place I go where no one knows

Pista wrote:Glad you got a patch on.
Blimey! I never knew Quiffy had stopped smoking.

Or even started, for that matter. :wink:
What a season
to be beautiful
without a reason
Top
User avatar
markfiend
goriller of form 3b
Posts: 21182
Joined: 11 Nov 2003, 10:55
Location: st custards
Contact:
Contact markfiend

Obviously I can't say too much, but this...
Heartland is not affected by this issue
I wish I could say the same about work. All patched now of course, but a lot of work was involved.

XKCD has an explanation of how the heartbleed bug works: http://xkcd.com/1354/
The fundamental cause of the trouble is that in the modern world the stupid are cocksure while the intelligent are full of doubt.
—Bertrand Russell
Top
User avatar
Quiff Boy
Herr Administrator
Posts: 16827
Joined: 25 Jan 2002, 00:00
Location: Lurking and fixing
Contact:
Contact Quiff Boy

Just a heads-up to let you know that I'm currently looking at a way of making Heartland run entirely over secure https

ie: https://www.myheartland.co.uk/

I've purchased the SSL certificate and begun setting it up on the server, but there's a bit more server setup and a bit of forum config required to make it all work seamlessly.

I'll be dabbling with this during the coming week, so apologies if you see any weirdness re: security messages from your browser - don't worry, it will just be me trying to get this working :urff:

I'll post more details when I have something concrete to report back 8)
What’s the difference between a buffalo and a bison?
Top
User avatar
markfiend
goriller of form 3b
Posts: 21182
Joined: 11 Nov 2003, 10:55
Location: st custards
Contact:
Contact markfiend

Fun fun fun!
The fundamental cause of the trouble is that in the modern world the stupid are cocksure while the intelligent are full of doubt.
—Bertrand Russell
Top
User avatar
Quiff Boy
Herr Administrator
Posts: 16827
Joined: 25 Jan 2002, 00:00
Location: Lurking and fixing
Contact:
Contact Quiff Boy

Seems to be working on Safari and Chrome, but Firefox is complaining about it being an invalid security certificate :(

Am working on it...

FWIW, we are definitely Heartbleed-proof ;)

https://www.ssllabs.com/ssltest/analyze ... land.co.uk
What’s the difference between a buffalo and a bison?
Top
User avatar
iesus
Overbomber
Posts: 4459
Joined: 15 Mar 2006, 11:15
Location: x-EU

Exception added on Firefox ;D
Always trust MH :D :notworthy: :notworthy:
'Are we the Baddies?'...
"Someday! Someday, everything you need, is just gonna fall out of the sky..." -A.E. Reading 1991
"Don't forget that most of the judges in witches trials had harvard degrees."
Top
User avatar
Quiff Boy
Herr Administrator
Posts: 16827
Joined: 25 Jan 2002, 00:00
Location: Lurking and fixing
Contact:
Contact Quiff Boy

Right that should have sorted it for Firefox now too 8)
What’s the difference between a buffalo and a bison?
Top
Pat
Slight Overbomber
Posts: 1359
Joined: 19 Jun 2005, 22:19

Still getting problems on firefox, just had to add it as an exception
Top
Bartek
Underneath the Rock
Posts: 6148
Joined: 17 Sep 2005, 10:47

FF constantly informs me that HL is not trustworthy. i'm adding exceptions, but i have cleaning history with closing browser.
Top
User avatar
lazarus corporation
Lord Protector
Posts: 3449
Joined: 09 May 2004, 17:42
Location: out there on a darkened road
Contact:
Contact lazarus corporation

Just been chatting with QB over email and he will be applying some technical wizardry (known as a "Post-GoT CRT Bundle File"). Should have it fixed soon.
Top
User avatar
lazarus corporation
Lord Protector
Posts: 3449
Joined: 09 May 2004, 17:42
Location: out there on a darkened road
Contact:
Contact lazarus corporation

lazarus corporation wrote:Just been chatting with QB over email and he will be applying some technical wizardry (known as a "Post-GoT CRT Bundle File"). Should have it fixed soon.
Should be fixed now.
Top
User avatar
Nikolas Vitus Lagartija
Overbomber
Posts: 2492
Joined: 04 Aug 2011, 23:35
Location: Scotland
Contact:
Contact Nikolas Vitus Lagartija

Well done, chaps :notworthy: :notworthy: I have no idea what any of the above means but I think it means that we can all sleep peacefully and carry on posting !
Top
User avatar
Quiff Boy
Herr Administrator
Posts: 16827
Joined: 25 Jan 2002, 00:00
Location: Lurking and fixing
Contact:
Contact Quiff Boy

:D

Thanks Laz ;)
What’s the difference between a buffalo and a bison?
Top
Bartek
Underneath the Rock
Posts: 6148
Joined: 17 Sep 2005, 10:47

it is fixed! :notworthy: :kiss:
Top
Post Reply

Return to “Announcements”