<div dir="ltr"><div>Well what was very inaccurate in his article and annoyed me was these parts :<br><br><blockquote>It was only on August 22 that Frields was permitted to announce that, "Last week we discovered that some Fedora servers were illegally accessed. The intrusion into the servers was quickly discovered, and the servers were taken offline . . . .One of the compromised Fedora servers was a system used for signing Fedora packages. However, based on our efforts, we have high confidence that the intruder was not able to capture the passphrase used to secure the Fedora package signing key."<br></blockquote>and <br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">By contrast, the Fedora-Red Hat announcements not only concealed information, but gave users no way to investigate their own system for problems, nor any means of protection beyond the negative one of not installing or updating. Faced with a security problem, Red Hat reacted far less like Debian and much more like Microsoft, which is notorious for denying security problems until a patch is ready. No doubt it tried to protect its corporate interests, but it did next to nothing for users. When trouble came, FOSS interests and standards were apparently jettisoned in favor of immediate business concerns. </blockquote><div><br> </div></div>Now while I agree about the fact that RedHat/Fedora were slow to announce the reason behind the infrastructure outage, I remember clearly that RedHat released on the 22'nd of August (he ignored this or he wasn't aware of it) detailed information about the intrusion and a shell script for users to check if there systems were affected or if the openssh package was compromised quoting from RedHat: "this script lists the affected packages and can verify that none of them are installed on a system: ", and is the link <a href="http://www.redhat.com/security/data/openssh-blacklist.html">http://www.redhat.com/security/data/openssh-blacklist.html</a> <br>I think someone should take the responsibility of replying to the author of this article just to correct his inaccuracies.<br> <br>Regards,<br>Tarek<br><br><div class="gmail_quote">2008/9/10 ankur sinha <span dir="ltr"><<a href="mailto:sanjay_ankur@yahoo.co.in">sanjay_ankur@yahoo.co.in</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; font-size: inherit; line-height: inherit; font-size-adjust: inherit; font-stretch: inherit;" valign="top"> <p>hi,</p><p></p><p>I dont realy think the articles worth too much..Both sides handled the situation as well as possible keeping boths interests in mind. Comaring it with Debians situation isnt right.. </p><p></p><p>regards,<br> </p><p></p><p>Ankur</p><p></p><br>--- On <b>Wed, 10/9/08, Shambo Bose <i><<a href="mailto:shambo.linux@gmail.com" target="_blank">shambo.linux@gmail.com</a>></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> From: Shambo Bose <<a href="mailto:shambo.linux@gmail.com" target="_blank">shambo.linux@gmail.com</a>><br>Subject: Re: [Ambassadors] The Fedora-Red Hat Crisis<br>To: <a href="mailto:fedora-ambassadors-list@redhat.com" target="_blank">fedora-ambassadors-list@redhat.com</a><br> Date: Wednesday, 10 September, 2008, 1:39 PM<div class="Ih2E3d"><br><br><div><div><br><br><div class="gmail_quote">2008/9/10 Peter Reuschlein <span dir="ltr"><<a rel="nofollow" href="mailto:peter@reuschlein.de" target="_blank">peter@reuschlein.de</a>></span><br> <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Tarek Taha schrieb:<br> <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div> <a rel="nofollow" href="http://itmanagement.earthweb.com/osrc/article.php/3770216/The+Fedora-Red+Hat+Crisis.htm" target="_blank">http://itmanagement.earthweb.com/osrc/article.php/3770216/The+Fedora-Red+Hat+Crisis.htm</a><br> <br> <br></div> ------------------------------------------------------------------------<br> <br> --<br> Fedora-ambassadors-list mailing list<br> <a rel="nofollow" href="mailto:Fedora-ambassadors-list@redhat.com" target="_blank">Fedora-ambassadors-list@redhat.com</a><br> <a rel="nofollow" href="https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list</a><br> </blockquote> <br> Good Article,<br> <br> sorry but a +1 for me... Its nearly like i saw and still see the things running currently.<br> <br> regards<br><font color="#888888"> Peter<br> <br> </font><br>--<br> Fedora-ambassadors-list mailing list<br> <a rel="nofollow" href="mailto:Fedora-ambassadors-list@redhat.com" target="_blank">Fedora-ambassadors-list@redhat.com</a><br> <a rel="nofollow" href="https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list</a><br> <br></blockquote></div><br><br>NICE !!!!<br></div> </div><pre>-- Fedora-ambassadors-list mailing list <a href="mailto:Fedora-ambassadors-list@redhat.com" target="_blank">Fedora-ambassadors-list@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list</a> </pre></div></blockquote></td></tr></tbody></table><br> <hr size="1"> Download prohibited? No problem. <a href="http://in.rd.yahoo.com/tagline_webmessenger_1/*http://in.webmessenger.yahoo.com/" target="_blank">CHAT</a> from any browser, without download.<br>--<br> Fedora-ambassadors-list mailing list<br> <a href="mailto:Fedora-ambassadors-list@redhat.com">Fedora-ambassadors-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-ambassadors-list</a><br> <br></blockquote></div><br><br clear="all"><br>-- <br> ---------------------------------------------------<br>Tarek Taha<br>Doctoral Candidate<br>ARC Centre for Autonomous Systems<br>University of Technology, Sydney<br>ph: +61 2 9514 3147<br> web: <a href="http://www.tarektaha.com">http://www.tarektaha.com</a> <br>---------------------------------------------------- <br> </div>