Note that they do not say that we will stop getting updates but merely that we won't be able to benefit from this "security feature". It does sound scary on a first read, though -- I got confused myself.

We use the v2.5.0 backport of geoipupdate on stretch systems and v3.1.1 on buster. There is a new upstream, v4.0.x, that is a rewrite from C to Go, but that is not yet packaged in Debian (note that I am the Debian maintainer for geoipupdate).

I checked both the git tip of the C and the Go versions and I found no references to any sort of hashing - both seem to use HTTP Basic Auth:

curl_easy_setopt(curl, CURLOPT_USERNAME, account_id);
curl_easy_setopt(curl, CURLOPT_PASSWORD, gu->license.license_key);

if config.AccountID != 0 {
        req.SetBasicAuth(fmt.Sprintf("%d", config.AccountID), config.LicenseKey)
}

I also looked for other branches, searched their documentation, searched at maxmind.com, etc. and found no references of this whatsoever. Perhaps this is for an upcoming release that they haven't released yet?

Also: the server supports HTTPS (and geoipupdate defaults to it), so I'm not sure how the hashing of license keys is going to help with anything...

@faidon: we don't have any updaters on our end, we just move the databases around and keep backups for historical use. But let us know if you run into any problems.

It's been around 10 months since the last update, anything pending here?

The swap of Traffic for Traffic-Icebox in this ticket's set of tags was based on a bulk action for all such tickets that haven't been updated in 6 months or more. This does not imply any human judgement about the validity or importance of the task, and is simply the first step in a larger task cleanup effort. Further manual triage and/or requests for updates will happen this month for all such tickets. For more detail, have a look at the extended explanation on the main page of Traffic-Icebox . Thank you!

Currently working on T288844 and added puppet code that allowed us to use a second, new, license for MaxMind geoip databases. So far evaluating that this new license works and can download databases including GeoIP2-Anonymous-IP.mmdb GeoIP2-Enterprise.mmdb which we did not have previously, but doing so in parallel to the existing setup to be careful.

@BBlack This sounds like a duplicate of T303464 (and/or /T302864) to me. Maybe you can just merge it.

I think this can be closed since it's in the past and superseded by T302864.