non-disclosure of infrastructure problem a management issue?

[Joel Rees]

> I think most of us were more peeved about not getting a *clear*  
> warning,
> promptly, and wanting to know whether it really was a safety issue (do
> not download) or just broken servers (downloads may fail).

They didn't say hardware, they didn't say source code control or  
other distribution software, they didn't say specific packages or  
distros, they didn't run around screaming, "Chicken Little was right!  
The sky is falling. RUN FOR THE HILLS!!!!"

So we should have assumed that there was some ambiguous state typical  
of a breach discovered in the early stages. From the information so  
far, that's what it was, and the post-mortem in such cases does take  
time.

Joel Rees