Post by @michael@westergaard.social

2026-09-04 15:51 UTC

Easy there tiger. From the release notes: Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information If every update is an emergency, none is. At least include this important bit if sending out alarmist posts.

Replies (2)

@kauer@aus.social 2026-09-06 00:14

@michael@westergaard.social @xrobau@mastodon.au (Regarding the MikroTik vulnerability mentioned recently): As far as I can tell: - if you don't use RSA keys, there is no problem - if you use RSA keys generated with the commonest exponent, 65537, there is no problem (ssh-keygen uses 65537) - if you don't use public keys, there is no problem (except that you are not using public keys :-) ) - if the public key you use is not known to the attacker, there is no problem - if the MikroTik device is not reachable by the attacker, there is no problem

Open ##5045559
@jez@social.jeremy.visser.name 2026-09-07 01:09

@michael@westergaard.social I have been using MikroTik for 15+ years now. Never have I seen them overstate the urgency of an update. They've set some special flags on this update such that the UI is promoting this much more strongly than typical updates. They don't cry wolf, and this is also not a case of them crying wolf.

Open ##5045573