Language Selection

English French German Italian Portuguese Spanish

Red Hat's security issue

Filed under
Linux
Security

Last month, Red Hat issued a security bulletin. Not all that went on is clear, but it seems that the servers used to develop and distribute Fedora and Red Hat were accessed by a person with criminal intent. The perpetrator created trap-door versions of the SSH (remote login program) packages that would compromise the security of Red Hat's customers, and signed them with Fedora's cryptographic key. These packages were made available via Fedora archive and they may (I've not proof) have reached some number of Fedora customers. Obviously they were intended to be widely distributed and to compromise the security of all Red Hat and Fedora systems. Red Hat issued a script that users can run to detect the compromised packages.

But there are continuing problems with Red Hat's handling of the situation.

Best practice of computer security professionals is to fully disclose what went wrong and how you're preventing it from happening again. This tells customer security officers what they need to audit the security practices of their vendor, and to secure their own facilities. The worst practice, for which Microsoft is the prototype, is to stay mum and not admit any problems.

Red Hat's being mum. Fedora's being forced to be mum, because their own board has not been given full details and of course they are mostly controlled by Red Hat.

Full Post




Also:

Security breaches bring out the proprietary attitude in all of us. When security is breached we instinctively hide the details, and build a metaphorical police line around it, telling onlookers to move along.

The security attitude runs counter to the open source attitude. Open source demands that bugs be seen and lessons shared. The security attitude fears this release of information because the evil doers might get it.

With that in mind let’s move to the umbrage of Bruce Byfield during what Slashdot termed last month’s Fedora-Red Hat crisis.

Fedora and our security attitude


More in Tux Machines

Red Hat News

Is Canonical the Victim of High Expectations?

When Ubuntu was new, those who questioned it were mostly Debian developers, disgruntled because they were not hired or because Ubuntu failed to acknowledge its debt to Debian. Today, however, a vocal minority seems to view Canonical Software, the company behind Ubuntu, as a Microsoft in the making. From being the uncritical darling of open source, Canonical is closely and cynically scrutinized, and its motives constantly questioned. So how did this transformation happen? Suspicion about corporations is hardly new in open source, yet Canonical seems singled out in a way that SUSE or Red Hat only occasionally are. Read more

Permabit offers deduplication to Linux masses – almost

Permabit has moved beyond OEMs, making the latest release of its dedupe technology available as a Linux software package so that ISVs, professional services folks and systems integrators in its Hybrid Cloud Professional Services partners programme can use it. Previously it was available to OEMs in Albireo (dedupe) and Virtual Data Optimizer or Virtual Data Optimizer, VDO (dedupe+compression+thin provisioning) form. VDO v6 is designed for the cloud service provider market, Permabit says, and the VDO for Hybrid Cloud package simplifies VDO installation and configuration in Red Hat Enterprise Linux (RHEL) data centres. Read more

Mozilla involves the community in its “open-source” rebrand

Mozilla is bending the terms of the rebrand with a “branding without walls” open-source initiative. Read more