Tonight, beginning at 11:59 PM, we will be performing maintenance on equipment that serves a portion of legacy DSL customers in both northern and southern California. Expected downtime is less than 10 minutes.
– Robbie
Month: April 2014
Intrusive Fiber DIA Maintenance
Tonight, April 28, starting at 11:59PM, we will be performing maintenance on aggregation gear servicing a subset of Fiber DIA subscribers. Expected downtime is less than 30 minutes.
Update: No customer traffic was affected during this maintenance window. Due to unforeseen circumstances, this maintenance is being postposed until the night of April 30, starting at 11:59PM.
Update: Maintenance complete.
– Tomoc and Robbie
Non-intrusive Voice Maintenance
Tonight (4/22/2014) beginning at 11:59PM PDT we will begin performing a software upgrade on portions of our voice network in Santa Rosa. No customer service impact is expected from this.
-Tim J.
Emergency Fusion/FlexLink Maintenance
Tonight, April 12, starting at 11:59PM, we will be performing intrusive emergency maintenance on equipment serving Fusion and FlexLink customers in the Cotati area. We estimate this maintenance will be completed within two hours.
-Tomoc and Clay
Heartbleed update
Hello,
All vulnerable keys have now been replaced. We still recommend changing your account password to mitigate the damage if this exploit was attacked on our system. The systems included in this last round of updates where:
- legacy-webmail.sonic.net
- forums.sonic.net
- wiki.sonic.net
– Grant and SOC
Non-intrusive Voice Maintenance
Tonight (4/10/2014) beginning at 11:59PDT we will be performing non-intrusive maintenance on our SBC in Santa Rosa. No customer impact is expected from this.
-Tim J
The Heartbleed Bug and You: Change Your Passwords!
We always keep your privacy and security in mind.
By now you’d be hard pressed to have missed coverage of The Heartbleed bug in OpenSSL.  At this point, Sonic.net is joining many other providers and recommending that you change your passwords for your online services.  This is important for high value accounts like banking and finance or other accounts that protect your personal information and data.  Do not forget to change your ISP and email account passwords!  These are especially important since access to your email account can be used to gain access into most of your online services.
We do not have any reason to believe that we, or any of our users, were targeted. Â However, this attack was undetectable and the cautious response is to assume that sensitive information has been leaked. Â In the interest of full disclosure we are providing a complete list of affected services and systems. Â It should be noted that all of the vulnerable services support PFS wherever possible and should our private keys have been leaked, they cannot be used to decrypt any past traffic in most cases.
Customers may change their passwords in the membertools using the password tool.
If you have any questions, please post them in our forums.
As of 21:45 on April 7th,  all vulnerable systems had received an update to fix this bug.
The following sites and services were vulnerable:
- imap.sonic.net (login credentials were not vulnerable, only keys)
- pop.sonic.net (login credentials were not vulnerable, only keys)
- mail.sonic.net (login credentials and mailflow in/out)
- legacy-webmail.sonic.net
- webmail.sonic.net
- forums.sonic.net
- wiki.sonic.net
- corp.sonic.net
- newsignup.sonic.net
- public-api.sonic.net (used by mobile apps)
- fusionbroadband.com (used by our wholesale partners and customers)
- srapi.sonic.net (used by our wholesale partners)
All of these systems have had their certificates replaced except for the following which are still pending reissue by our CAs:
UPDATE: All systems have had their keys replaced.
legacy-webmail.sonic.netwiki.sonic.netforums.sonic.net
The following sites and services were not vulnerable due to running an early version of OpenSSL:
- mx.sonic.net (inbound mail)
- members.sonic.net
- signup.sonic.net
- listman.sonic.net
Pop/Imap servers key update.
In a few moments we will be updating the Pop and Imap servers’ ssl keys due to the Heartbleed bug. Fortunately the way our servers are configured they where not vulnerable  to exposing authentication information due to this bug, but there is a chance that the keys where compromised. Expect a brief interruption while the keys are installed, after which incoming mail service will be restored.
– Grant and SOC
Webmail.sonic.net Certificate update
UPDATE: The new certificate has been installed.
In the next few minutes we will be pushing a new SSL certificate to our webmail servers. There will be a brief service interruption while this is done. This is one of the last few steps required in cleaning up after the Heartbleed openssl vulnerability.
– Grant and SOC
Server Updates
Update:
All work is complete as of 1:00am on Wednesday, April 9th.
Tonight, April 8th, at 11:59pm, System Operations will be updating and rebooting several systems, including load balancers. This may cause a brief interruption in any web-based services and mail.
— Joe and the SOC