The Fedora-Red Hat Crisis (Datamation)

True. If it turns out that RH discovered a previously unknown but used-in-the-wild exploit and then sat on it for some weeks without telling anyone, then everyone will want to lynch them, absolutely.

But I'm assuming that isn't the basis for your argument, because that would mean you were arguing for pre-lynching them *just in case* they were hiding such information, and I respect you more than that :-). It's still *entirely* possible that they don't know the exploit, or it was a known exploit, or it was a previously unknown exploit that they have quietly reported (any number of security fixes have been released since the break-in was discovered, after all). Right?

>But if there was an undiagnosed exploit that potentially effected my system, I'd want a start on protecting myself against it and figuring it out. Having the existing information would certainly help.

But that was my point -- what sort of existing information do you imagine would help? Or make it concrete: in the Debian compromise, the initial announcement basically just said "somehow they got root, we don't know how". That was the only public information available until the details on the exploit were announced ~2 weeks later. How did you act differently during those two weeks? And if you acted differently, then *why*, given that we all know that there are undiagnosed root exploits in all of our boxes?

Just admit that you want all the details including the meaty story, not just the facts that directly affect users. My sense in reading your comments is that you want RedHat to reveal all the details of the crime, the pirates of silicon valley type story describing the compromise in detail including a breakdown step by step of what the cracker did and maybe even the commands the cracker used. That's a press story, a crime novel if you will, not anything of value to system admins. As a sys-admin, not a kernel hacker I want to know what was compromised, what I need to do to stay secure and what will happen to update the system. The press release covered that. They laid out what they think happened, they told everyone not to update any package till they could update the signing keys and then they updated the signing keys and issued new updates.

The only thing I can surmise is that you believe they are engaged in a coverup and that more damage was done then they are revealing which would realistically be corporate suicide.