<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Thanks Jeff - the reason I think it's an appropriate question for that list is that InCommon staff actively monitors that list and is in a position to reply to InCommon policies, practices and recommendations there. Since you asked about InCommon recommendations, likely that's the place to ask. Your question may prompt a discussion of this issue there, which I think would be valuable.<br></div><div><br></div><div>Best,</div><div><br></div><div>Nick</div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Jeff Silverman" <jeff@moodlerooms.com><br><b>To: </b>"Shib Users" <users@shibboleth.net><br><b>Sent: </b>Tuesday, April 8, 2014 12:41:46 PM<br><b>Subject: </b>Re: OpenSSL heartbleed bug / Shibboleth implications<br><div><br></div><div dir="ltr">Hi, Nicholas. I apologize -- and I do not mean to sound snarky! -- but I'm not sure I understand why that list is better for this question. I thought my question directly related to the topic at hand? Also, there is basically no activity on that mailing list over the last 24 hours. (This is probably me not sure where the line is drawn between Shib and InC conversations)<div>
<div><br></div><div>I've tried due diligence before posting this question but the best answer I can derive is "maybe"</div><div><br></div><div>- We don't have any reason to believe we've been compromised</div>
<div>- We are only running Shib SP services</div><div>- We've applied patches to everything from our vendor</div><div><br></div><div>Since the InC recommended new cert rollout process can take up to two weeks, I'm curious how others are approaching cert replacement.</div>
<div><br></div><div>Thanks,</div></div><div>JDS</div></div><div class="gmail_extra"><br><div><br></div><div class="gmail_quote">On Tue, Apr 8, 2014 at 12:15 PM, Nicholas Roy <span dir="ltr"><<a href="mailto:nsr11@psu.edu" target="_blank">nsr11@psu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-size:12pt;font-family:times new roman,new york,times,serif"><div>That would be a good question for the InCommon Participants list.<br>
</div><div><br></div><div>Best,</div><div><br></div><div>Nick</div><div><br></div><div><span></span>Nicholas Roy - Penn State - Information Technology Services<br><a href="mailto:nicholas-roy@psu.edu" target="_blank">nicholas-roy@psu.edu</a><br>
tel <a href="tel:%2B1%20814%20867%200115" target="_blank">+1 814 867 0115</a><br><span></span><br></div><div><br></div><hr><div style="font-size:12pt;font-style:normal;font-family:Helvetica,Arial,sans-serif;text-decoration:none;font-weight:normal">
<b>From: </b>"Jeff Silverman" <<a href="mailto:jeff@moodlerooms.com" target="_blank">jeff@moodlerooms.com</a>><br><b>To: </b>"Shib Users" <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Sent: </b>Tuesday, April 8, 2014 11:51:08 AM<div class=""><br><b>Subject: </b>Re: OpenSSL heartbleed bug / Shibboleth implications<br><div><br></div></div><div><div class="h5"><div dir="ltr">Does InC Recommend replacing signing and/or encryption keys in response to this vulnerability?<div>
<br></div><div>Thanks,</div><div>-- </div><div class="gmail_extra"><div style="text-align:left">Jeffrey D. Silverman • Moodlerooms, Inc.</div>
<div style="text-align:left"><a href="tel:%28410%29%20779-3425" target="_blank">(410) 779-3425</a> • <a href="mailto:jeff@moodlerooms.com" target="_blank">jeff@moodlerooms.com</a></div>
</div></div>
<br>
</div></div><span style="">This email and any attachments may contain confidential and proprietary information of Moodlerooms that is for the sole use of the intended recipient. If you are not the intended recipient, disclosure, copying, re-distribution or other use of any of this information is strictly prohibited. Please immediately notify the sender and delete this transmission if you received this email in error.</span><div class="">
<br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></div></div><div><br></div></div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div style="text-align:left">
Jeffrey D. Silverman • Moodlerooms, Inc.</div><div style="text-align:left">(410) 779-3425 • <a href="mailto:jeff@moodlerooms.com" target="_blank">jeff@moodlerooms.com</a></div>
</div>
<br>
<span style="background-color:rgb(255,255,255)">This email and any attachments may contain confidential and proprietary information of Moodlerooms that is for the sole use of the intended recipient. If you are not the intended recipient, disclosure, copying, re-distribution or other use of any of this information is strictly prohibited. Please immediately notify the sender and delete this transmission if you received this email in error.</span><br>--<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div><div><br></div></div></body></html>