Language Selection

English French German Italian Portuguese Spanish

Red Hat's security issue

Filed under
Linux
Security

Last month, Red Hat issued a security bulletin. Not all that went on is clear, but it seems that the servers used to develop and distribute Fedora and Red Hat were accessed by a person with criminal intent. The perpetrator created trap-door versions of the SSH (remote login program) packages that would compromise the security of Red Hat's customers, and signed them with Fedora's cryptographic key. These packages were made available via Fedora archive and they may (I've not proof) have reached some number of Fedora customers. Obviously they were intended to be widely distributed and to compromise the security of all Red Hat and Fedora systems. Red Hat issued a script that users can run to detect the compromised packages.

But there are continuing problems with Red Hat's handling of the situation.

Best practice of computer security professionals is to fully disclose what went wrong and how you're preventing it from happening again. This tells customer security officers what they need to audit the security practices of their vendor, and to secure their own facilities. The worst practice, for which Microsoft is the prototype, is to stay mum and not admit any problems.

Red Hat's being mum. Fedora's being forced to be mum, because their own board has not been given full details and of course they are mostly controlled by Red Hat.

Full Post




Also:

Security breaches bring out the proprietary attitude in all of us. When security is breached we instinctively hide the details, and build a metaphorical police line around it, telling onlookers to move along.

The security attitude runs counter to the open source attitude. Open source demands that bugs be seen and lessons shared. The security attitude fears this release of information because the evil doers might get it.

With that in mind let’s move to the umbrage of Bruce Byfield during what Slashdot termed last month’s Fedora-Red Hat crisis.

Fedora and our security attitude


More in Tux Machines

Leftovers: Software

Emulation or WINE

Fedora: The Latest

  • New "remi-php71" repository
  • PHP on the road to the 7.1.0 release
  • First round of Fedora 24 Updated Lives now available. (torrents expected later this week)
    As noted by my colleague on his blog the first round of F24 Updated Lives are now available and carry the date 20160720, Also as mentioned last week on his blog F23 Respins are not going to be actively made, however we and the rest of the volunteer team will field off-off requests as time and resources permit. We are considering a new/second tracker for the Updated Spins but as of today there are only .ISO files available at https://alt.fedoraproject.org/pub/alt/live-respins [shortlink] F24 Live-Respins . The F24 respins carry the 4.6.4-200 Kernel and roughly ~500M of updates since the Gold ISOs were released just 5 weeks ago. (some ISOs have more updates, some less)

Leftovers: Ubuntu

  • Snappy Packaging Happenings In The Fedora, Arch Space
    This week Canonical hosted a Snappy Sprint in Heidelberg, Germany where they worked to further their new package management solution originally spearheaded for Ubuntu Touch. This wasn't an Ubuntu-only event, but Canonical did invite other distribution stakeholders. Coming out of this week's event were at least positive moments to share for both Arch and Fedora developers. The Arch snaps package guy made progress on snap confinement on Arch. Currently when using Snaps on Arch, there isn't any confinement support, which defeats some of the purpose. There isn't any confinement support since it relies upon some functionality in the Ubuntu-patched AppArmor with that code not yet being mainlined. Arch's Timothy Redaelli has got those AppArmor patches now running via some AUR packages. Thus it's possible to get snap confinement working on Arch, but it's not yet too pleasant of an experience.
  • PhantomJS 2.1.1 in Ubuntu different from upstream
    At the moment of this writing Vitaly's qtwebkit fork is 28 commits ahead and 39 commits behind qt:dev. I'm surprised Ubuntu's PhantomJS even works.
  • Ubuntu 16.04.1 LTS released
    Ubuntu 16.04 is a LTS version of Ubuntu.Now Ubuntu team has announced the release of it's first point release,Ubuntu 16.04.1.This first point release includes many updates containing bug fixes and fixing security issues as well and as always what most of users want from a distribution and most of distributions tries to perform,Stability.This release is also well focoused on stabilty as Ubuntu 16.04.