Do you rely on mailing lists or news articles for security vulnerabilities? Please share.

I only got to know about xz/liblzma [1] and curl [2] [3] vulnerabilities through lemmy (maybe because of high severity?).

  1. 1 ↩︎

  2. 2 ↩︎

  3. 3 ↩︎

  • Björn Tantau@swg-empire.de
    3·
    8 months ago

    I do regular automated updates. For anything requiring human intervention like the xz thing I trust Lemmy and YouTube to keep me updated. No dedicated news source because if I were to freak out about every new vulnerability found I wouldn’t be able to sleep at night.

      • Björn Tantau@swg-empire.de
        1·
        8 months ago

        If you had it on a computer that is accessible via SSH from the internet you should proceed under the assumption that it was compromised. Which means you should reinstall from a safe medium and change your keys and passwords.

    • corsicanguppy@lemmy.ca
      1·
      8 months ago

      Same for the RPM ecosystem: yum-cron and walk away. Been that way for almost 25 years.

      Having been involved with OS Security in the middle of my career, I also still watch feeds like I used to; just, different ones, now.

  • Brunacho@scribe.disroot.orgEnglish
    1·
    8 months ago

    My distribution (archlinux) notifies of critical vulnerabilities that require user action. There’s a news mailing list.

    After that I rely on social network (Mastodon mostly) or lemmy for news, as vulnerabilities often get some conversation. Apart from that, software i’m really interested in I also follow through RSS so I get news when they update for their vulnerabilities -that is when the vulnerabilities are not self inflicted as the xz case-.

  • PlexSheep@feddit.de
    1·
    8 months ago

    I didn’t really consider that there are feeds for such things, especially for my distro(s). Embarrassing, but it means you helped making me safer!

    I’m now subscribed to the Debian security list, seeing as all my servers run Debian. I just had unattended upgrades with Mail logs before.

  • kylian0087@lemmy.dbzer0.com
    1·
    8 months ago

    I actually have automated security updates on all my servers. Also in general i run greenbone at home that does daily scans of all the VLANS/networks I have at home.

  • AlphaAutist@lemmy.world
    0·
    8 months ago

    You can watch rss feeds to follow all CVEs like Microsoft’s https://api.msrc.microsoft.com/update-guide/rss

    NIST used to have an rss feed for CVEs but deprecated it recently. They still have other ways you can follow it though https://nvd.nist.gov/vuln/data-feeds

    Or if you just want to follow CVEs for certain applications you can host/subscribe to something like https://www.opencve.io/welcome which allows you to filter CVEs from NIST’s National Vulnerability Database (NVD)