To be clear, I'm not advocating carrying around older libraries, but I am strongly advocating using a distro that is not based on package versions from 5+ years ago or a distro that is no longer actively maintained if you want any sense of stability or security. There are many fixes that come in the form of new API's that simply are not possible to backport, or major fixes that do not meet the requirements for backport in other ways. Using centos5 for example will become much much more difficult for the user in future freeswitch 1.4 releases because freeswitch simply needs capabilities added to libraries within the last 5 years, that are just not readily available on centos5. This will require users to manually install more recent versions of libraries to meet dependency requirements, which of course negates all of the reasons you use a distro in the first place. Mike On Apr 4, 2014, at 11:30 AM, R P Herrold <herrold@owlriver.com> wrote:

On Fri, 4 Apr 2014, R P Herrold wrote:

Following on myself, this paper [1] touches on similar issues which are uncovered in current Open Source crypto libraries and tools

I know there was a comment in the JIRA [2] distrusting whether enerprise vendors backport security fixes. I strongly disagree with that view. Certainly the upstream of CentOS is quite good about issuing prompt fixes which backport into a stable API, and moving away from locally carried libraries is a good way to get securitry updates, 'for free' into FreeSwitch, compared to using old 'carried around' tarballs of indeterminate security

-- Russ herrold

[1] https://www.cs.utexas.edu/~shmat/shmat_oak14.pdf [2] https://jira.freeswitch.org/browse/FS-353

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org