From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: Re: [PATCH] index.cgi: Display a warning if the last Core Update was installed more than 90 days ago Date: Tue, 18 Jan 2022 21:21:25 +0000 Message-ID: <993eb6cf-c4b2-844f-0031-147345bf795d@ipfire.org> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0376871600086421046==" List-Id: --===============0376871600086421046== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Michael, thanks for your reply. Yes, differentiating the update message is a good idea - in terms of UX, it i= s probably the better one. And yes, 90 days are fine for me. On the one hand, this nudges us to release = updates faster, and on the other hand, we can expect users to respond to a new update within = a month. Sure, there are maintenance windows and things like that in corporate environments,= but if they cannot react to a security-relevant update within 30 days, perhaps they shoul= d ask themselves if their internal procedures are still suited for today's threat landscape. Thanks, and best regards, Peter M=C3=BCller > Hello, >=20 >> On 15 Jan 2022, at 09:15, Peter M=C3=BCller w= rote: >> >> At the time of writing, Fireinfo reports more 51.67% of all >> installations reporting back to us are running at least two Core Updates >> older than the latest one. >> >> While I doubt we can expect our userbase to patch their systems within >> 24 hours (which is the recommended timespan given for critical >> infrastructures by multiple CERTs), if they the last Core Update was >> installed more than 90 days ago, we can safely consider the system in >> question being outdated and insecure. >> >> Therefore, this patch displays a warning on index.cgi, in addition to >> the "an update is available" message - in the hope to nudge people to >> keep their IPFire machines up to date. >=20 > I am not sure whether it is a good idea to have this in addition. I would p= refer a highlighted message if someone is more than one update behind. There = should be a difference between: >=20 > Hey, we just wanted to let you know that a new update is available. >=20 > And: >=20 > Dude, you really need to make sure your system is up to date. >=20 > I understand that 90 days sounds long, but considering that we take up to 6= 0 days between releases, this only leaves you with 30 days. Is that really wh= at you are going for here? >=20 > -Michael >=20 >> >> Signed-off-by: Peter M=C3=BCller >> --- >> html/cgi-bin/index.cgi | 10 +++++++++- >> langs/de/cgi-bin/de.pl | 1 + >> langs/en/cgi-bin/en.pl | 1 + >> 3 files changed, 11 insertions(+), 1 deletion(-) >> >> diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi >> index 2b7ccdb0f..fbd656988 100644 >> --- a/html/cgi-bin/index.cgi >> +++ b/html/cgi-bin/index.cgi >> @@ -2,7 +2,7 @@ >> ##########################################################################= ##### >> # = # >> # IPFire.org - A linux based firewall = # >> -# Copyright (C) 2007-2014 IPFire Team = # >> +# Copyright (C) 2007-2022 IPFire Team = # >> # = # >> # This program is free software: you can redistribute it and/or modify = # >> # it under the terms of the GNU General Public License as published by = # >> @@ -541,6 +541,14 @@ if ( ! -e "/var/ipfire/main/send_profile") { >> $warnmessage .=3D "
  • $= Lang::tr{'fireinfo please enable'}
    • "; >> } >> >> +# Running on likely outdated Core Update (last update was more than 90 da= ys ago) >> +my ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size, $atime, $mtime, = $ctime, $blksize, $blocks) =3D stat "/opt/pakfire/db/core/mine"; >> +my $core_update_age =3D time() - $mtime; >> + >> +if ( "$core_update_age" > "7776000" ) { >> + $warnmessage .=3D "
  • $Lang::tr{'outdated installation warning'}
    • "; >> +} >> + >> # EOL architecture >> my ($sysname, $nodename, $release, $version, $machine) =3D &POSIX::uname(); >> if ($machine =3D~ m/^i.86$/) { >> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl >> index c81b28fea..2ae0f948c 100644 >> --- a/langs/de/cgi-bin/de.pl >> +++ b/langs/de/cgi-bin/de.pl >> @@ -1878,6 +1878,7 @@ >> 'otherport' =3D> 'Anderer Port', >> 'our donors' =3D> 'Unsere Unterst=C3=BCtzer', >> 'out' =3D> 'Aus', >> +'outdated installation warning' =3D> 'Diese IPFire-Installation ist veral= tet, was ein Sicherheitsrisiko darstellt. Bitte aktualisieren Sie das System = schnellstm=C3=B6glich.', >> 'outgoing' =3D> 'ausgehend', >> 'outgoing compression in bytes per second' =3D> 'Abgehende Kompression', >> 'outgoing firewall' =3D> 'Ausgehende Firewall', >> diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl >> index 2f7038fb1..8d1eb3e2d 100644 >> --- a/langs/en/cgi-bin/en.pl >> +++ b/langs/en/cgi-bin/en.pl >> @@ -1914,6 +1914,7 @@ >> 'otherport' =3D> 'other Port', >> 'our donors' =3D> 'Our donors', >> 'out' =3D> 'Out', >> +'outdated installation warning' =3D> 'This IPFire installation is outdate= d, which is a security risk. Please check for and install updates as soon as = possible.', >> 'outgoing' =3D> 'outgoing', >> 'outgoing compression in bytes per second' =3D> 'Outgoing compression', >> 'outgoing firewall' =3D> 'Outgoing Firewall', >> --=20 >> 2.31.1 >=20 --===============0376871600086421046==--