LWN.net Logo

The Fedora-Red Hat Crisis (Datamation)

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 4:06 UTC (Thu) by rahvin (subscriber, #16953)
In reply to: The Fedora-Red Hat Crisis (Datamation) by BrucePerens
Parent article: The Fedora-Red Hat Crisis (Datamation)

Bruce that is exactly the information authority figures wouldn't want released as it's the information they use during interrogations to get the suspect to reveal details they can't know unless they are one that did it. Not only that, but you previously claimed that you want information on security implications that could effect RedHat/Fedora system installs. Outside what items were directly compromised the details of what the user did are nothing more than the details of the crime. Sure they make a good story but they aren't going to help you know anything about security implications to your installs.

Just admit that you want all the details including the meaty story, not just the facts that directly affect users. My sense in reading your comments is that you want RedHat to reveal all the details of the crime, the pirates of silicon valley type story describing the compromise in detail including a breakdown step by step of what the cracker did and maybe even the commands the cracker used. That's a press story, a crime novel if you will, not anything of value to system admins. As a sys-admin, not a kernel hacker I want to know what was compromised, what I need to do to stay secure and what will happen to update the system. The press release covered that. They laid out what they think happened, they told everyone not to update any package till they could update the signing keys and then they updated the signing keys and issued new updates.

The only thing I can surmise is that you believe they are engaged in a coverup and that more damage was done then they are revealing which would realistically be corporate suicide.


(Log in to post comments)

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 5:51 UTC (Thu) by BrucePerens (subscriber, #2510) [Link]

I want the facts that directly effect users, and was answering how they would be determined if there was a penetration that wasn't fully understood.

At least one user I've heard from got compromised ssh packages that were distributed from a corrupt Fedora archive. He doesn't know if they were actually used to penetrate his system. He has little choice but to wipe every password, every private key, etc. He can't get any help from Fedora, because Fedora is itself being kept in the dark.

This is just not the way an Open Source product should be operated. If Red Hat is going to work like Microsoft, they're no better than Microsoft.

Why the heck did we work on this software for years just to have corporations that screw over their own customers and the Open Source teams that feed them?

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 7:25 UTC (Thu) by njs (subscriber, #40338) [Link]

>At least one user I've heard from got compromised ssh packages that were distributed from a corrupt Fedora archive. He doesn't know if they were actually used to penetrate his system.

Wait, what? The official word from Fedora is that there were no compromised packages whatsoever. (And from RH that there are compromised ssh packages, but that they were not distributed.) If there's information otherwise, then shouldn't he (or you) be contacting Fedora, and possibly also media outlets?

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 7:41 UTC (Thu) by BrucePerens (subscriber, #2510) [Link]

Wait, what? The official word from Fedora is that there were no compromised packages whatsoever. (And from RH that there are compromised ssh packages, but that they were not distributed.)
I've heard from one person who says his system failed the test script that Red Hat distributed. I don'k know him and can't attest to his reliability. I don't know if it's a false positive.

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 7:52 UTC (Thu) by njs (subscriber, #40338) [Link]

Oh, so it was RH? I guess that would be another reason he couldn't get help from Fedora :-). But that's an easy mix-up to make...

If he really did fail the test script, though, then I bet he can get help: presumably the investigators would *love* to figure out how that package got onto his system, since whoever put it there must have contact with the RH attackers... OTOH: random emailer of unknown provenance, making an unverifiable claim that would make news if real but hasn't, and whining about how they can't get help when they would have if they tried? Obviously I don't know him either, but kind of tingles my internet-attention-seeker sense.

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 8:02 UTC (Thu) by mspevack (subscriber, #36977) [Link]

I don'k [sic] know him and can't attest to his reliability.

Then why are you spreading FUD? -1 (Troll)

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 12:58 UTC (Thu) by skvidal (subscriber, #3094) [Link]

If you'd like to pass along his name/email, it'd be handy to know where he obtained this package from.

It wasn't from what is on the master mirror, I can assure you of that.

The Fedora-Red Hat Crisis (Datamation)

Posted Sep 11, 2008 22:50 UTC (Thu) by wingo (subscriber, #26929) [Link]

Bruce. That's twice. *Affect.*

Respectfully, Andy.

Copyright © 2012, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds