My Amahi machine is doing it's job and being an OpenVPN server so that I can connect to my network while I'm traveling and my friends can hit my minecraft server and some other stuff. Which. . . would mean it's exposed to the internet yes?
I suppose that could be true that it's somewhat exposed. From what I have read, VPN should be harder to crack. I could be wrong.
The mere fact I'm posting on these forums, means anyone in the Universe can tell there's an Amahi server running at thebardingreen.yourhda.com.
That is not true as you can be posting here and not have an Amahi server running. Now that you have posted your server access name (if that is the actual name), it could be easier to hack into your machine.
The openVPN folks consider this a serious issue. But Amahi does not?
I never said we did not consider it serious, however there is nothing Amahi can do for your server to correct this issue. I would think if it was a concern for users, we would have notified the Amahi community of actions needed to mitigate the threat. Since it's OpenSSL which is an OS package, not Amahi there it nothing we can do. We cannot control whether the OS chooses to update OpenSSL or not and when.
Should I assume this means you have no plans to patch Windows HDA Connect in the short term?
I don't use the HDA Connect. Does it contain OpenSSL for Windows? If so, then we would need to update it.
Please don't misunderstand my previous post. What my main point was is to simply state this is not something to panic over in regards to an Amahi server. From all I have read, the big concerns were passwords being stolen for online accounts. In my opinion, this would be most worrisome for online banking but not home servers so much.
We did patch all the Amahi sites immediately, so no passwords or information could be compromised as a result of this threat.
I will have to ask about the HDA Connect app. I am unsure who supports it on the team.
EDIT: This might help answer some questions.
http://p37.ny.sl.pt