| |||||||||||||
|
| |||||||||||||
The Fedora-Red Hat Crisis (Datamation)The Fedora-Red Hat Crisis (Datamation)Posted Sep 11, 2008 5:51 UTC (Thu) by BrucePerens (subscriber, #2510)In reply to: The Fedora-Red Hat Crisis (Datamation) by rahvin Parent article: The Fedora-Red Hat Crisis (Datamation) I want the facts that directly effect users, and was answering how they would be determined if there was a penetration that wasn't fully understood. At least one user I've heard from got compromised ssh packages that were distributed from a corrupt Fedora archive. He doesn't know if they were actually used to penetrate his system. He has little choice but to wipe every password, every private key, etc. He can't get any help from Fedora, because Fedora is itself being kept in the dark. This is just not the way an Open Source product should be operated. If Red Hat is going to work like Microsoft, they're no better than Microsoft. Why the heck did we work on this software for years just to have corporations that screw over their own customers and the Open Source teams that feed them?
(Log in to post comments)
The Fedora-Red Hat Crisis (Datamation) Posted Sep 11, 2008 7:25 UTC (Thu) by njs (subscriber, #40338) [Link]
>At least one user I've heard from got compromised ssh packages that were distributed from a corrupt Fedora archive. He doesn't know if they were actually used to penetrate his system.
Wait, what? The official word from Fedora is that there were no compromised packages whatsoever. (And from RH that there are compromised ssh packages, but that they were not distributed.) If there's information otherwise, then shouldn't he (or you) be contacting Fedora, and possibly also media outlets?
The Fedora-Red Hat Crisis (Datamation) Posted Sep 11, 2008 7:41 UTC (Thu) by BrucePerens (subscriber, #2510) [Link] Wait, what? The official word from Fedora is that there were no compromised packages whatsoever. (And from RH that there are compromised ssh packages, but that they were not distributed.)I've heard from one person who says his system failed the test script that Red Hat distributed. I don'k know him and can't attest to his reliability. I don't know if it's a false positive.
The Fedora-Red Hat Crisis (Datamation) Posted Sep 11, 2008 7:52 UTC (Thu) by njs (subscriber, #40338) [Link]
Oh, so it was RH? I guess that would be another reason he couldn't get help from Fedora :-). But that's an easy mix-up to make...
If he really did fail the test script, though, then I bet he can get help: presumably the investigators would *love* to figure out how that package got onto his system, since whoever put it there must have contact with the RH attackers... OTOH: random emailer of unknown provenance, making an unverifiable claim that would make news if real but hasn't, and whining about how they can't get help when they would have if they tried? Obviously I don't know him either, but kind of tingles my internet-attention-seeker sense.
The Fedora-Red Hat Crisis (Datamation) Posted Sep 11, 2008 8:02 UTC (Thu) by mspevack (subscriber, #36977) [Link] I don'k [sic] know him and can't attest to his reliability.Then why are you spreading FUD? -1 (Troll)
The Fedora-Red Hat Crisis (Datamation) Posted Sep 11, 2008 12:58 UTC (Thu) by skvidal (subscriber, #3094) [Link]
If you'd like to pass along his name/email, it'd be handy to know where he obtained this package from.
It wasn't from what is on the master mirror, I can assure you of that.
The Fedora-Red Hat Crisis (Datamation) Posted Sep 11, 2008 22:50 UTC (Thu) by wingo (subscriber, #26929) [Link]
Bruce. That's twice. *Affect.*
Respectfully, Andy.
|
|
||||||||||||