Re: LWP Can't connect to api-ssl.bitly.com

[ww]

FWIW, current version (on CPAN) of IO::Socket::SSL is 2.015. Net::SSLeay vers. is 1.68. And LWP::Protocol::https is 6.06.

Can you update your modules? Seems to me we've recently (March) heard about an exploitable weakness (aka "FREAK" and/or "the heartbleed bug") in some versions of SSL.

But this may be a red herring. Your problem statement, "Since two days i can't generate bitly url" to a native English speaker strongly suggests that prior to two days ago, you were able to "generate bitly url."

If that's actually the case here, what changed (other than the inability to build short URLs)?

[Anonymous Monk]

Thanks.

Nothing has changed, the website code is the same. It just stopped working (generating short link) giving the error above. It worked for the last 18 months until April 10 (first time the error show up on logs).

What frustrate me is that i cannot reproduce the same error on the development.

I know it the modules are olds. I am working on migrating the website to some thing newer. If i have to update just one module which one should i update (just worried about breaking the site)?

[kcott]

"Nothing has changed, the website code is the same."

Although your code may not have changed, this does not mean that "Nothing has changed". [Assumption: "website code" is "your code"]

Check with your sysadmin, ISP, or equivalent for changes to server(s). This could be related to hardware, configuration, environment, etc.

[Anonymous Monk]

Thanks. Our server is on rackspace. My predecessor installed all the packages/modules needed to run the website. I talked to rackspace but they did not make any changes that would affect the server.

[ww]

re "which one (module)..." to change:

1. if, as kcott inferred, the change is at your hosting service or by your syssadmin you'll have to take his advice: talk to the supplier. Your observation that you can't reproduce the error on the dev box (I assume that's what you meant) reinforces, for me, anyway, the notion that 'the other guy' made a change, but didn't tell you.
2. if the issue is related to an update (by others) calculated to minimize opportunities for an exploit, and you actually control the production box, you might want to check and see if there's any kind of auto-update process that you've not noticed (logs may help as might other sleuthing thru the software, OS included.

Finishing the thought: OTOH, suppose the change is at bitly -- that would explain their rejection of an older SSL protocol. Again, check the source....

And finally, the Perl Porters go to great lengths to avoid "breaking" things; backward compatibility (at least to 5.8 or maybe 5.6) is a high priority precisely because some major users are so slow (reluctant?) to update. What you're talking about is not quite as ancient, but both your Ubuntu and your Perl date to well before the discovery of the SSL problem (or others which come less readily to mind).

[Anonymous Monk]

when i use curl on the terminal i have an answer (short link is created). Does that mean that it is not related to openssl?