ClamAV Forced Upgrade Breaks Email Servers 299
An anonymous reader writes "A couple of weeks ago Sourcefire announced end-of-life for version 0.94 of its free ClamAV antivirus package (and in fact has been talking about it for six months). The method that Sourcefire chose to retire 0.94 was to shut down the server that provided its service. Those who had failed to upgrade are scrambling now. Many systems have no choice but to disable virus checking in order to continue to process email. I am very glad I saw the announcement last week!"
Alternative (Score:5, Insightful)
Re:Alternative (Score:5, Insightful)
It's kind of an inflammatory article:
So, it's a year and two versions out of date AND they'd been saying for 6 months to move off it.. Yet still it's their fault for shutting down the server!? I'm sorry, but how much support do you want for something that's free?
Re:Alternative (Score:5, Informative)
It's quite a bit more extreme than just shutting down one of their servers. They issued a final "signature" update that literally caused each installation of that version to stop functioning.
From the announcement [clamav.net] :
Starting from 15 April 2010 our CVD will contain a special signature which disables all clamd installations older than 0.95 - that is to say older than 1 year.
Re:Alternative (Score:5, Insightful)
Would you trust an email server that is running a virus scanner that is more than a year out of date?
Re:Alternative (Score:4, Insightful)
Would you trust an email server that is running a virus scanner that is more than a year out of date?
Would you trust a company who would remotely shut off your anti-virus?
Re:Alternative (Score:4, Informative)
Also, I'd rather it stop working then keep working and not get definition updates.
Re:Alternative (Score:5, Interesting)
It's more complicated than that.
Older versions of clamd were going to crash on signatures that newer versions would accept, and they have been prevented for at least 6 months from using that type of signature. They have posted since then for people to upgrade.
When they did was publish this type of signature (has to do with length, greater than about 900bytes), where the signature itself is an error message, so when the program dumped the signature the error would be displayed.
That's all, not a kill switch as such, but using a known bug to deliver a message, rather than have it just bomb out with a hex dump when they tried to use a larger signature.
Re: (Score:2, Interesting)
Yep, and when did they post that? 6 months ago. McAfee recently gave us 2 months notice at work that pre 8.x client would no longer be supported - not a problem as 7.1 was eol ages ago - since then there's been 8.0, 8.5 and currently 8.7 which we're moving to.
No big deal for those who properly manage their systems.
Re: (Score:3, Informative)
Honestly, for things like this that I don't have the time to do right I prefer to let someone else do them. In this case, why not route your mail through Postini or another service? I'm pretty sure that I can't hope to do a better job filtering than Google...
Re: (Score:3, Insightful)
I got hit by the shutdown too, however I'm not upset. If I was paying for it I would have been angry at the vendor for not notifying me. But it's a FREE antivirus service. The folks that publish ClamAV updates aren't under any obligation to keep my systems up and running. If my systems were that important, I'd pay for something with an SLA.
Re:Alternative (Score:5, Informative)
Uh, it HAS been filling your log files with warnings about upgrading for months, if not years. It's pretty f'ing explicit:
LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq [clamav.net] ***
--Quentin
Re:Alternative (Score:4, Funny)
The "DON'T PANIC!" was obviously the wrong message to display for something that was going to break your mail server.
Re:Alternative (Score:5, Insightful)
The issue has nothing to do with your servers, really; it has to do with their servers. If you're using a free service on someone else's servers, you really can't be surprised when that service suddenly stops functioning. It's not your equipment.
And I would wager that while visiting the blogs of everything on your servers isn't practical, visiting the blogs of (or subscribing to a mailing list, or other monitoring of) everything that's on your servers but uses someone else's servers is practical
Re:Alternative (Score:4, Insightful)
This such a perfect example of a loser with attitude that I deserves comment. Look at the breakdown of points, hitting every checkbox:
1) Implies that anyone who criticizes his failure to do this job is ignorant of his difficult working conditions.
2) Implies that doing is job is an unreasonable burden that no one could expect, despite other people managing it, sometimes under conditions that he has no idea how difficult they are.
3) Implies that he did absolutely nothing wrong: his configuration was not an issue--that it was right and reasonable to have his servers configured to crash on failure of this "low priority" component, like a mechanic telling you it's right and reasonable for the wheels to fall off if the radio stops working, because the radio operating correctly is a low priority.
4) Implies that he's a hero for fixing a problem he caused by his neglect and incompetence. Despite his low pay he's on call all the time, and worked for hours fixing things brilliantly and heroically, despite having mis-configured a low-priority component as a critical system whose incidental failure could crash the whole works.
5) Blames someone else who did thier job well, and for free. Accuses a supplier of a free service who have been filling his logs with messages for six months of not filling his logs with messages for six months, and then accuses them of deliberately crashing his incompetently configured servers.
6) Re-iterates how over-worked he is and how much he has to do.
7) Proclaims he's going to look for another free service to blame his next failure on Real Soon Now.
Classic, classic whiner. Your job may suck, man, and that may not be all your fault, but if you don't fix the attitude you'll be stuck in the suck for a long, long time...
Re: (Score:2, Insightful)
When you make assumptions, you're an ass.
I don't watch TV at work. I'm busy because I'm the only IT guy in our organization, and I do everything, on top of regular office work, on a shoestring budget.
So while you're sitting in your office preparing the budget to show your boss how many tens of thousands of dollars the new M$ Exchange system is going to cost, maybe think about how lucky you are to be able to do what you love to do full time, with a budget, and proper support staff.
So you had 6 months to upgrade (Score:5, Insightful)
Re: (Score:3, Funny)
go fuck yourself
uh. this is slashdot. for most of us, that is a redundant instruction.
what would have been far more offensive is
go fuck someone else
as we all know that's not possible for most of us. ...you insensitive clod.
Re:So you had 6 months to upgrade (Score:5, Interesting)
Kinda my attitude, too. Had this affect a bunch of servers yesterday. Started researching, found the cause, and solved the problem in 30 minutes on 35 or so servers. Totally my own damned fault for not staying upgraded. Worst impact was that messages were delayed on a few mail server for half an hour and uploads to a handful of webservers threw errors because of the way I scan them. Users tried again. Problem solved.
Re: (Score:2, Insightful)
So you had 6 months to upgrade and you didn't, and now are going to complain when shit doesn't work?
No, but they'll complain (rightfully so) when the developers issue a "killswitch" command causing the software to quit working. So it's not like the servers disappear and stuff broke from obsolescence, they issued a command to the servers and had the software shut itself down (documented here [clamav.net]).
Re: (Score:2)
Don't know about gparent, but I'm effected by endless clueless customers whining that their email server broke.
Re: (Score:2)
Oh this is awesome! I'll be able to bill many more hours to fix this one once the emails start rolling in... hey, WTFs wrong with my mail server?
Re:So you had 6 months to upgrade (Score:5, Funny)
I'm effected by endless clueless customers whining that their email server broke.
While such an occurrence would prompt me into action, I doubt it would prompt me into existence. ;)
Re: (Score:2)
Re: (Score:2)
Volatile (Score:3, Informative)
You really should use the volatile repository. It provides updated versions of packages that are required to change (like antivirus), compiled for stable. You end up with stable + required updates.
Re: (Score:3, Funny)
Re: (Score:2)
I accept e-mail, phonecalls, text messages, and Facebook.
Updating your support site does not count as "let me know".
Re: (Score:3, Informative)
Re:So you had 6 months to upgrade (Score:5, Informative)
I had modded this overrated, but this really deserves a reply.
You're in the wrong place if you expect sympathy. There are a lot of other sysadmins here. There are a lot who wear all of the hats. You're not alone.
You had a poorly designed or poorly implemented mail system. That isn't clamAV's fault. It's not their fault that you didn't upgrade or check your system logs. This is no different than forgetting to pay the maintenance bill on a commercial mail gateway or hosted solution. Would you blame Symantec, McAfee, Microsoft, or CA if you didn't pay the bill and your mail stopped flowing?
The fact that you didn't follow a blog or mailing list about a critical piece of your infrastructure says a lot about you as a sysadmin. They're even on Facebook and Twitter. If you can't take the time to keep an eye on your mail gateway or antivirus product, what else aren't you keeping up on. Think about that for a few minutes, set up a Google reader account, and then start subscribing to blogs. If you have a smartphone, add Google reader to your RSS Reader. It makes good bathroom reading.
Got This Bounce This Morning (Score:5, Informative)
Diagnostic-Code: smtp; /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket /var/spool/amavisd/clamd.sock: No such file or directory) at (eval 55) line 310.
/usr/bin/clamscan unexpected exit 50, output="LibClamAV Error: cli_hex2str(): Malformed hexstring: This ClamAV version has reached End of Life! Please upgrade to version 0.95 or later.
451-4.5.0 Error in processing, id=02792-02, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x83d7540) Too many retries to talk to
ClamAV-clamscan av-scanner FAILED:
At least their error messages are descriptive and informative.
Re: (Score:2, Flamebait)
> At least their error messages are descriptive and informative.
Indeed. Accurate error messages are something that Microsoft never quite achieved, and Apple never even tried. "It does not work, please have a look at our website www.fuckandall.com for possible causes" - I hate that!
[clamav-announce] (Score:5, Insightful)
Re: (Score:2)
It exists for a reason.
I'm going to subscribe to it now. I don't want to go though that again.
But I can't subscribe to the announce list for every free software product I use, I'd do nothing else but read these lists.
Re:[clamav-announce] (Score:5, Informative)
announce lists are intentionally very low traffic. I'm subscribed to over 50, and I rarely receive more than 4 or 5 mails a week at most.
Re: (Score:2)
this is common (Score:5, Insightful)
This is what we get when we're all our own "netadmins". I'm one of them. I don't follow security lists. I don't upgrade my products. Why not? Because I'm not really a netadmin. I just have a little server that runs until it breaks. I think that's the difference between a netadmin and a fake netadmin -- a fake netadmin like me reacts. A real netadmin is proactive.
Which honestly, as pathetic as it sounds on the surface, works fairly well when your data and uptime don't matter. Because it's not pathetic because I have better things to do with my time than "run the family webserver".
Re: (Score:2)
I got bored with being a "netadmin" once I started university. I moved my family's email to Google Apps, stopped giving free webspace to anyone that didn't already know what "SSH" meant, and haven't regretted it one bit.
I do still have the server, but it only runs Apache. I looked into hosting, but I use ~20GB for photographs. Hosting for that is too expensive.
(Although, I did run aptitude dist-upgrade every couple of months so probably wouldn't have been hit by this problem.)
Package Managers (Score:2)
This is why you rely on package management software. There are actual maintainers out there who keep up-to-date on issues like this, that affect their packages.
For instance, if you're running any version of Ubuntu, you are on v0.95.3 or v0.96 [ubuntu.com] right now, so you would not have even known about this EOL had it not been on slashdot. Every time you log into Ubuntu, it will warn you if you need to do some updates.
If you are not a professional system administrator (neither am I, by the way, so I feel for you), y
Re: (Score:2)
I can accept that; how can we fix the 99% of us running broken due to apathy?
No fallback ? (Score:5, Insightful)
People with critical servers that don't have fallback configurations to handle this kind of thing deserve to have their servers shutdown.
I've been using 0.95 for some time now, so none of my servers were affected but, even if they were, my servers are smart enough not to interrupt the services, and to notify me.
It is really disgusting the way people build servers these days. They think all they need to do is to install a couple packages, change a couple config lines and boom, the server is ready. They are getting what they asked for when stuff like this happens.
Re: (Score:2)
Re: (Score:2)
Yeah, noone really got hurt here.. just some delayed mail. I logged into my effected server and had clamav upgraded in 10 mins. It wasn't ideal but now I know I should have subscribed to the mailing list!
Re: (Score:2)
"Passing e-mails without checking in case the AV failed" is not really a fallback, at least not one I would recommend.
I was talking about having a second, different AV for that.
Re: (Score:3, Informative)
I had two mail servers, on two Internet connections. If either went down I'd get an alert and could fix it without mail being affected. I didn't expect both to stop processing mail at the same time. It's always the stuff you don't expect to fail that fails.
My mail was queued on DMZ mailers so nothing was lost, but it was delayed. Some of it may have been business critical.
*Correction* (Score:5, Interesting)
The method SourceFire chose to use was to encode a kill command in the ClamAV updates. If they had simply "shut down the [update] server" ClamAV would have continued to work, just without new signatures.
See their announcement at http://www.clamav.net/lang/en/2009/10/05/eol-clamav-094/ [clamav.net]
Re: (Score:3, Informative)
Starting from 15 April 2010 our CVD will contain a special signature which disables all clamd installations older than 0.95 – that is to say older than 1 year.
[snip]
We recommend that you always run the latest version of ClamAV to get optimal protection, reliability and performance.
Thanks for your cooperation!
FYI, ClamAV, DOA != cooperation.
Re: (Score:2)
So, they did the right thing. What is the big deal?
Yes, they did the right thing... (Score:4, Insightful)
As someone who was bitten by the issue (yeah, I'll man up and admit it - my company's mail server went wonky for about a half hour while I upgraded) I agree -- they pretty much did the right thing.
There was plenty of notice -- The fact that many of us weren't on the clamav-announce list is OUR fault, not theirs.
A kill command may not be the most "polite" way of retiring an old version of software, but for a free service I certainly don't expect them to invest huge amounts of time and money in figuring out how to support the old stuff forever.
Re:*Correction* (Score:4, Insightful)
I personally consider use of a remote signature update system as a kill switch to be abuse of the update system.
Re:*Correction* (Score:5, Insightful)
Wow. They could have just stopped publishing updates for older versions; they do have some method of versioning, right?. Older installations could have kept chugging along using the older definitions and newer installations could get the newer definitions. But to remotely *DISABLE* older installations? I don't care if the product and service is free or not; that is pretty fucked up.
Re:*Correction* (Score:4, Insightful)
What's fucked up about it? It's a huge security problem to be running an email server that is using a virus scanner whose definitions are over a year old.
Re: (Score:2, Informative)
Definitions were upgraded, though, weren't they? Just the engine was a year old...
Re:*Correction* (Score:5, Informative)
The definitions were up to date (but would become out of date when they started pushing large (>980 bytes) definition updates next month, which the old version cannot handle), but the version was not.
Re: (Score:2)
No.
Look for the post by ccandreva to explain why.
Re: (Score:2)
Re: (Score:2)
That’s a very good thing to point outstill, though, it’s certainly not fair that having ClamAV get administratively killed from afar means that your email service coughs and dies.
Re: (Score:2)
Can, sure, but it sounds like that isn’t the default action. While the default’s safer, and I’m all for safety in my systems, too many end users have become too dependent on email for it to suddenly go away because of a package failure like that. It’s especially disturbing, reading TFA, to find that a lot of high-profile spam services abruptly shut down as a result. Those guys should have been ready for it.
Re: (Score:2)
Thank you.
I would have been happy as a ... clam... if the way this went down was for me to simply find my log files full of warnings this morning.
Instead, SourceFire chose to willfully break people's mail configurations, causing a huge amount of stress for those of us who are mail system maintainers.
Tisk, tisk... (Score:5, Funny)
Those freetards just don't understand the valuable features provided by quality proprietary software.
I was hit hard too...! (Score:2, Insightful)
...and guess what! I'm almost sure I have had enough of free software.
Not to say that it odes not do its work but because there is no incentive "not to break stuff", read 'continued revenue streams', folks just do as they please and we get hurt.
Heck! Is this the "freedom" you want?
Re: (Score:2)
Heck! Is this the "freedom" you want?
What, the freedom for your system to be very slightly unstable if you fail to upgrade a piece of software a year out of date after six months of warnings?
Re: (Score:2)
Yes, because you're not paying for it! Do you expect companies who have to make a buck be nice to leechers like you?
When was the last time you donated to OpenBSD for all their contributions such as OpenSSH? If so many of your are going to be evil leechers, then companies have no choice and all the say.
Re: (Score:2)
You know the "free" part there doesn't mean you are free not to do a good job, right ? Because, you know, you are not.
People still should know what they are doing. I never saw this announcement regarding 0.94, but nevertheless, none of my servers stopped.
Re: (Score:2)
Heck! Is this the "freedom" you want?
Yes, thanks. While I have seen some frustrating breakages in OSS before (I recall several different Ubuntu updates that broke Xorg, the bastards), this isn't one of them. The software is a year out of date. You're given six months warning. Continuing to run after that time (if it were possible) would mean that your long-outdated version is no longer receiving definition updates -- so you'd be left with a false sense of security that you're somehow protected when you weren't.
if they had just issued a r
Re: (Score:2)
Why because you were too lazy to update your AV software from a year ago?
ClamAV did the right thing, they could have simply shoved out the new AV database that would have had your AV crash with a wierd error, because your horribly out of date version was incompatible with the new larger database format. but no they made sure you had a informative error so you would know what to do.
But it's their fault and OSS fault... DAMN THOSE OSS PEOPLE!
Re: (Score:2)
Re: (Score:2)
...and guess what! I'm almost sure I have had enough of free software.
Not to say that it odes not do its work but because there is no incentive "not to break stuff", read 'continued revenue streams', folks just do as they please and we get hurt.
Heck! Is this the "freedom" you want?
For six months their web site, the clamav-announce mailing list and your log files have over and over again explained that the version was out of date and would be discontinued; it's not like this just happened overnight. But that's not even the point.
The point is that this was in your best interests, although it may not seem like it now. Given that you hadn't updated for six months they could be pretty sure you weren't going to upgrade now; most likely you don't check the log files or the mailing lists bec
so clam breaks if a remote server is down? (Score:2)
If it breaks because a remote server went away it sounds like it is time to possibly have another look at that code.
Re: (Score:2, Informative)
It wasn't the server going away. They delivered an update designed to kill it
The Windows equivalent would be Microsoft Delivering a critical update with XP designed to disable windows, because you haven't updated to Vista yet.
In other words, they used the automatic update service against their own users.
From now on, my recommended course of action is that all mail administrators running clamav should REMOVE or DISABLE any automatic updates of ClamAV rules, make sure to comment out any crontab entri
Re: (Score:2)
No, not even remotely close. Upgrading ClamAV is trivial and costs nothing. If you're not keeping your security software up to date, you've failed utterly.
Re:so clam breaks if a remote server is down? (Score:4, Insightful)
Nice FUD. the new DB will break it anyways.. and YES microsoft does this.
They crafted a DB update that used that bug to deliver a message so the logs showed you what happened instead of a "seg fault - error in line 45867"
Re: (Score:2)
What were they supposed to do exactly?
They've been warning users for 6 months that this was coming. The new style signature files for .95 and up were GOING to crash .94 installations. They're mirrors can't support supplying both old and new style signatures and the .95+ clients would have been _less secure_ because of a constrained signature file size. On top of all that if you'd go read their statement they ALSO cannot support an auto upgrade to .95 because of server constraints.
Also, I have a feeling that
Re: automatic binary updates (Score:2, Insightful)
From now on, my recommended course of action is that all mail administrators running clamav should REMOVE or DISABLE any automatic updates of ClamAV rules, make sure to comment out any crontab entries for freshclam.
<SARCASM>
Mmhmm, yes. I agree 1000%. Don't update your virus signatures. Because ya know, new viruses don't get created very often. You can run with signatures over a year old and still have great protection!
</SARCASM>
Or do what they should do... include a method for automatically applying version updates.
Or force auto version update instead of disabling.
<SARCASM>
Yes, because distributing software for several versions of Free/Net/OpenBSD, each Linux distribution, Windows, Solaris, AIX, HP-UX, etc. is totally feasible for a free project.
It's not like they would have to fund the time, equipment and distribution bandwidth for t
Re: (Score:2)
From now on, my recommended course of action is that all mail administrators running clamav should REMOVE or DISABLE any automatic updates of ClamAV rules, make sure to comment out any crontab entries for freshclam.
If you're not going to keep the virus signatures up to date, what's the point of even running it?
It's a little shocking to me that anyone was caught by surprise on this. Ubuntu and Debian volatile are running 0.95+. I assume the other distros are, as well.
If you don't intend to apply the security fixes to your server, do not run a server. Pay somebody else to do it for you.
Re: (Score:2)
It isn't a remote server shutting down, they issued a "signature" update that caused each installation of a version prior to 0.95 to stop functioning.
Re: (Score:2)
You could try taking another look at the problem.
The server is up. It specifically tells 0.94.x and earlier that "thou art broken"
EOL annountment from Oct 2009 (Score:5, Informative)
End of Life Announcement: ClamAV 0.94.x
Oct 5, 2009
All ClamAV releases older than 0.95 are affected by a bug in freshclam which prevents incremental updates from working with signatures longer than 980 bytes.
You can find more details on this issue on our bugzilla (see bug #1395)
This move is needed to push more people to upgrade to 0.95 .
We would like to keep on supporting all old versions of our engine, but unfortunately this is no longer possible without causing a disservice to people running a recent release of ClamAV.
The traffic generated by a full CVD download, as opposed to an incremental update, cannot be sustained by our mirrors.
We plan to start releasing signatures which exceed the 980 bytes limit on May 2010.
We recommend that you always run the latest version of ClamAV to get optimal protection, reliability and performance.
Thanks for your cooperation!
Hm... (Score:2)
Debian Debs Outdated (Score:5, Informative)
# cat
5.0.4
aptitude output during update:
Setting up clamav-daemon (0.94.dfsg.2-1lenny2)
Starting ClamAV daemon: clamd LibClamAV Warning:
LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***
LibClamAV Warning:
LibClamAV Error: cli_hex2str(): Malformed hexstring: This ClamAV version has reached End of Life! Please upgrade to version 0.95 or later. For more information see www.clamav.net/eol-clamav-094 and www.clamav.net/download (length: 169)
LibClamAV Error: Problem parsing database at line 742
LibClamAV Error: Can't load daily.ndb: Malformed database
LibClamAV Error: cli_tgzload: Can't load daily.ndb
LibClamAV Error: Can't load
ERROR: Malformed database
It appears debian repositories also need to be updated.
NOTE: I removed the * (star) chars from the warnings due to junk filter.
Re: (Score:3, Informative)
The ClamAV package in Debian Lenny-Volatile is 0.95.3. You're using the package from Debian Lenny, which is stable, and doesn't mesh well with ClamAV, which is either the latest and greatest or broken.
Debian Volatile is meant specifically for this kind of thing.
Re: (Score:2)
Debian Volatile is meant specifically for this kind of thing.
And indeed I'm running stable-volatile for my mail server, so I never would have found out about this, had it not been posted to slashdot.
But it is truly shocking to me that Debian lenny hasn't been updated via security.debian.org. I know they're under a freeze and all, but there are about a half dozen bugs filed against clamav that warned this was going to happen. Not sure what the logic was in refusing to upgrade, despite this being a well-known to the maintainer issue.
If they don't want to keep clamav
Re: (Score:2)
It appears debian repositories also need to be updated. :(
In general, you may safely assume that to be the case for any given package.
Re: (Score:2)
It appears debian repositories also need to be updated. :(
Follow the instructions here [debian.org] and then do the update. You'll be up and running in a jiffy.
What the fuck Slashdot? (Score:3, Insightful)
First you complain when Microsoft releases an update that won't install on compromised systems because it would break them entirely.
Now ClamAV is put in a similar position. They have three choices due to the bug in 0.94:
1. Continue supporting 0.94, flood out their update servers with full updates since incrementals won't work with that version much longer.
2. Stop supporting 0.94, leaving users who don't know to update basically unprotected.
3. Send a clear message to users who haven't updated that their antivirus solution is now broken and they need to upgrade.
To me, 3 is the obvious choice. If this was a paid solution or if it cost a fucking dime to upgrade I might see a point to complaining, but to anyone who was still using 0.94 just man the fuck up, apt-get update, apt-get upgrade, and get on with it.
This is not like Microsoft disabling XP to get you to upgrade to Vista, this is more comparable to an aircraft with faulty parts being grounded by the FAA. Those using 0.94 were doomed to a broken solution one way or another, they could not continue using it and expect it to do its job, so they needed a kick in the ass to upgrade.
Re: (Score:2)
Overconfidence (Score:3, Informative)
Misleading, yes? (Score:3, Informative)
Re:FUCK JEWS (Score:5, Funny)
FUCK JEWS
When they are exceedingly attractive, female, not married, and expressing interest, I do.
Re: (Score:2)
This is the best Slashdot post I've read all week.
Natalie and grits (Score:5, Funny)
Be careful, though. Natalie Portman might pour hot grits on you.
Where do I sign up sir?
Re:It's not like they didn't tell... (Score:4, Insightful)
SUPPORT WILL END does not imply killing instances in production. It implies you stop delivering support services (such as tech support or new updates).
How would you feel if the Ubuntu folks delivered a 'security update' to Ubuntu 8.x to disable your system entirely, until you can get a chance to go install a non-EOL'd major release of your OS?
How about all those Windows Vista users who haven't upgraded to Windows 7?
Firefox 2 users who haven't upgraded to 3.
Users who are still using IE6.
Would users trust the vendors anymore with auto-updates, if they all released updates to 'kill the old product' in order to force you to manually do a clean upgrade?
Re: (Score:2)
If any of those examples were providing services where support ending means the thing is not doing its job anymore, you might have a point.
In this case, no more updates for 0.94 means 0.94 effectively does not work. There is nothing at all preventing any user from upgrading to the current version, so there's nothing wrong with forcing them to do so when the old solution is no longer working.
Re: (Score:2)
I totally agree. I was bitten by this on several servers. The sad part is that in some cases this is NOT really always our choice here.
Sometimes management or customers (in my case) CHOOSE to not allow me to spend the time or money to do more than the minimums. In this current economy, it's become a serious situation.
I really appreciate CLAM and the coders that support and maintain it. It is their prerogative to make the call. I just wish they would have done it differently. If a closed-vendor did thi
Re: (Score:2)
You're missing the fundamental issue. Upgrading to .95 _was_ the minimum requirement. You should have gone to your clients and said "This work needs to be performed to keep your AntiVirus current for your email server.".
Re: (Score:2)
The problem here is that once support services end, they stop writing new signatures for the old version of ClamAV. If an administrator has been ignoring (or has been unaware of) the impending end-of-life of ClamAV for the past 6 months, they are going to remain unaware of the problem basically forever.
There are four ways to handle this:
1. Contact all of your users. How?? Those who have subscribed to the updates list already know. You don't have to register to have ClamAV, so for most of the rest they
Re: (Score:2)
Exactly!
Anyways, the e-mail telling thing will break as been sent many times..
Re: (Score:2)
I guess it all boils down to "which is worse":
1. A broken security tool that is obviously broken, or
2. A half-broken security tool that looks like it's working OK?
Umm, I'll take #1 for priceless security, Alex.
As soon as ClamAV stops sending out freshclam for a version, that version should fail. As spectacularly and noisily as possible. It should scream of its obsolescence from the rooftops, and prevent any service depending on it from doing jack schitt until it gets fixed.
Re: (Score:2)
Or maybe people should ... you know ... not apply updates directly to their production servers without testing them first ?
No, that would be too radical. Who ever heard of updates causing problems ? It would never happen.
Re: (Score:2)
Anti-Virus updates are considered priorities here.
It is tested on a server, if it works good we update production. It takes less than 15min of my time..
Re: (Score:2, Funny)
With a name like ClamAV, my bet would be the Scientologists.