The Fedora-Red Hat Crisis (Datamation)

True. If it turns out that RH discovered a previously unknown but used-in-the-wild exploit and then sat on it for some weeks without telling anyone, then everyone will want to lynch them, absolutely.

But I'm assuming that isn't the basis for your argument, because that would mean you were arguing for pre-lynching them *just in case* they were hiding such information, and I respect you more than that :-). It's still *entirely* possible that they don't know the exploit, or it was a known exploit, or it was a previously unknown exploit that they have quietly reported (any number of security fixes have been released since the break-in was discovered, after all). Right?

>But if there was an undiagnosed exploit that potentially effected my system, I'd want a start on protecting myself against it and figuring it out. Having the existing information would certainly help.

But that was my point -- what sort of existing information do you imagine would help? Or make it concrete: in the Debian compromise, the initial announcement basically just said "somehow they got root, we don't know how". That was the only public information available until the details on the exploit were announced ~2 weeks later. How did you act differently during those two weeks? And if you acted differently, then *why*, given that we all know that there are undiagnosed root exploits in all of our boxes?