7:21 a.m.
Anyone that wants to edit/fix, have a go at it and then lets fire it out
the door ASAP.
https://fedoraproject.org/wiki/FWN/Issue140#Breaking_News_on_the_Infrastr...
--
Oisin Feeley
http://fedoraproject.org/wiki/OisinFeeley
7:41 a.m.
Looks goo here, Oisin. Thanks for pulling this together! I think it is
ready to push out.
- pascal
Oisin Feeley wrote:
Anyone that wants to edit/fix, have a go at it and then lets fire it
out
the door ASAP.
https://fedoraproject.org/wiki/FWN/Issue140#Breaking_News_on_the_Infrastr...
7:44 a.m.
Oisin Feeley wrote:
Anyone that wants to edit/fix, have a go at it and then lets fire it
out
the door ASAP.
https://fedoraproject.org/wiki/FWN/Issue140#Breaking_News_on_the_Infrastr...
I added the link for [8a] which was missing (hope the URL I added is the
correct one)
--
nicu :: http://nicubunu.ro :: http://nicubunu.blogspot.com
Cool Fedora wallpapers: http://fedora.nicubunu.ro/wallpapers/
Open Clip Art Library: http://www.openclipart.org
my Fedora stuff: http://fedora.nicubunu.ro
7:46 a.m.
On Fri, 2008-08-22 at 08:21 -0400, Oisin Feeley wrote:
Anyone that wants to edit/fix, have a go at it and then lets fire it
out
the door ASAP.
https://fedoraproject.org/wiki/FWN/Issue140#Breaking_News_on_the_Infrastr...
I'm really convinced that this adds anything substantial to the
discussion over and above what Paul says in his most recent mail. In
addition, it repeats "Public speculation" and "guesses" that are of
limited value (e.g., these issues are completely unrelated to the Debian
ssh issues, and repeating such speculation will just reinforce it in
weak minds for years to come).
-1 on sending a special issue.
--
Chris Tyler
(Who still hasn't received the Aug 22 mail from Paul, ???!)
7:51 a.m.
On Fri, 2008-08-22 at 08:46 -0400, Chris Tyler wrote:
On Fri, 2008-08-22 at 08:21 -0400, Oisin Feeley wrote:
> Anyone that wants to edit/fix, have a go at it and then lets fire it out
> the door ASAP.
>
>
https://fedoraproject.org/wiki/FWN/Issue140#Breaking_News_on_the_Infrastr...
I'm really convinced that this adds anything substantial to the
discussion over and above what Paul says in his most recent mail. In
addition, it repeats "Public speculation" and "guesses" that are of
limited value (e.g., these issues are completely unrelated to the Debian
ssh issues, and repeating such speculation will just reinforce it in
weak minds for years to come).
Whoops, I mashed up my own message here... should have read "I'm not
convinced..."
-Chris
7:53 a.m.
Chris Tyler wrote:
(Who still hasn't received the Aug 22 mail from Paul, ???!)
Those who are not subscribed to the Fedora lists.
To me, this is more transparency, which is a good thing.
--
nicu :: http://nicubunu.ro :: http://nicubunu.blogspot.com
Cool Fedora wallpapers: http://fedora.nicubunu.ro/wallpapers/
Open Clip Art Library: http://www.openclipart.org
my Fedora stuff: http://fedora.nicubunu.ro
8 a.m.
On Fri, 2008-08-22 at 15:53 +0300, Nicu Buculei wrote:
Chris Tyler wrote:
> (Who still hasn't received the Aug 22 mail from Paul, ???!)
Those who are not subscribed to the Fedora lists.
To me, this is more transparency, which is a good thing.
Ok, that sounds reasonable, but why repost the speculation and guesses?
Why mention the Debian thing, and switching from DSA to RSA (neither of
which apply here)? That just muddies the situation and will leave people
with the wrong impressions.
-Chris
8:11 a.m.
On Fri, Aug 22, 2008 at 9:00 AM, Chris Tyler <chris(a)tylers.info> wrote:
On Fri, 2008-08-22 at 15:53 +0300, Nicu Buculei wrote:
> Chris Tyler wrote:
> > (Who still hasn't received the Aug 22 mail from Paul, ???!)
>
> Those who are not subscribed to the Fedora lists.
>
> To me, this is more transparency, which is a good thing.
Ok, that sounds reasonable, but why repost the speculation and guesses?
Why mention the Debian thing, and switching from DSA to RSA (neither of
which apply here)? That just muddies the situation and will leave people
with the wrong impressions.
-Chris
I agree with Chris I 'perused' the current copy and the first words
that alarmed me were 'modification of a kernel'. Despite the fact that
it's a note, which should at best be a link the casual reader will
assume someone modified a Fedora kernel, pushed it out, and that will
cause hysterics. I see no need to mention Debian's problems.
8:12 a.m.
Chris Tyler wrote:
On Fri, 2008-08-22 at 15:53 +0300, Nicu Buculei wrote:
> Chris Tyler wrote:
>> (Who still hasn't received the Aug 22 mail from Paul, ???!)
> Those who are not subscribed to the Fedora lists.
>
> To me, this is more transparency, which is a good thing.
Ok, that sounds reasonable, but why repost the speculation and guesses?
Why mention the Debian thing, and switching from DSA to RSA (neither of
which apply here)? That just muddies the situation and will leave people
with the wrong impressions.
I agree with Chris Tyler. Adding more information than what is already
provided in the announcement is risky since it seems like there are more
followups expected.
Rahul
8:18 a.m.
On Fri, Aug 22, 2008 at 9:00 AM, Chris Tyler <chris(a)tylers.info> wrote:
On Fri, 2008-08-22 at 15:53 +0300, Nicu Buculei wrote:
> Chris Tyler wrote:
> > (Who still hasn't received the Aug 22 mail from Paul, ???!)
>
> Those who are not subscribed to the Fedora lists.
>
> To me, this is more transparency, which is a good thing.
Ok, that sounds reasonable, but why repost the speculation and guesses?
Why mention the Debian thing, and switching from DSA to RSA (neither of
which apply here)? That just muddies the situation and will leave people
with the wrong impressions.
I would agree with removing the speculation and guesses, including
removing the Debian thing. The DSA vs. RSA bit has some relevance as
Fedora Contributors are needing to re-upload their SSH keys to FAS and
DSA keys are no longer accepted to my knowledge.
~Jeffrey
8:29 a.m.
Jeffrey Tadlock wrote:
I would agree with removing the speculation and guesses, including
removing the Debian thing. The DSA vs. RSA bit has some relevance as
Fedora Contributors are needing to re-upload their SSH keys to FAS and
DSA keys are no longer accepted to my knowledge.
Yes, however this happened sometime *before* the incident.
Rahul
8:35 a.m.
On Fri, Aug 22, 2008 at 9:29 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
Jeffrey Tadlock wrote:
> I would agree with removing the speculation and guesses, including
> removing the Debian thing. The DSA vs. RSA bit has some relevance as
> Fedora Contributors are needing to re-upload their SSH keys to FAS and
> DSA keys are no longer accepted to my knowledge.
Yes, however this happened sometime *before* the incident.
Rahul
RSA-only has been stated policy - but I don't think it was actually
enforced until they brought FAS back up.
8:41 a.m.
On Fri, Aug 22, 2008 at 9:35 AM, David Nalley
<david.nalley(a)fedoraproject.org> wrote:
On Fri, Aug 22, 2008 at 9:29 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
> Jeffrey Tadlock wrote:
>
>> I would agree with removing the speculation and guesses, including
>> removing the Debian thing. The DSA vs. RSA bit has some relevance as
>> Fedora Contributors are needing to re-upload their SSH keys to FAS and
>> DSA keys are no longer accepted to my knowledge.
>
> Yes, however this happened sometime *before* the incident.
RSA-only has been stated policy - but I don't think it was actually
enforced until they brought FAS back up.
Yes, that is correct. The How-To page used to show creating the ssh
key as a DSA key. Then the Debian thing happened and the wiki page
was changed to show creating RSA keys. The infrastructure team
scanned the servers for vulnerable DSA keys, but did not force the
removal of DSA keys shortly after the Debian issue. It was during the
FAS rebuild over the past week that actual enforcement of no DSA keys
was added.
~Jeffrey
8:45 a.m.
David Nalley wrote:
RSA-only has been stated policy - but I don't think it was actually
enforced until they brought FAS back up.
You were not allowed to create DSA keys even before a couple of months
https://fedorahosted.org/fedora-infrastructure/ticket/540
That indeed was a response to the Debian issue but let's not mix these.
Rahul
8:57 a.m.
On Fri, Aug 22, 2008 at 9:45 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
David Nalley wrote:
>
> RSA-only has been stated policy - but I don't think it was actually
> enforced until they brought FAS back up.
You were not allowed to create DSA keys even before a couple of months
While you weren't allowed to add new DSA keys, a DSA key that existed
prior to 5/29 was still acceptable in FAS.
Now that all the keys have been purged this will mean those trying to
add the same key back into FAS will run into problems, and that will
generate questions.
9 a.m.
On Fri, Aug 22, 2008 at 9:45 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
You were not allowed to create DSA keys even before a couple of
months
https://fedorahosted.org/fedora-infrastructure/ticket/540
That indeed was a response to the Debian issue but let's not mix these.
Ah, you are right. I checked my IRC logs and it was said the change
happened near the FAS2 upgrade, which I read as during this most
recent outage upgrade.
David is right though, the change is now going to affect more people
which will generate questions. So the disallowing of DSA keys is
still relevant and informative to people who might be uploading keys.
~Jeffrey
4:25 p.m.
On Fri, 22 Aug 2008 10:00:53 -0400, "Jeffrey Tadlock"
<snip>
So, it's many hours later and no one has availed themselves of the edit
function of the wiki (except for Nicu's correction, thank you) and
nothing has gone out. I guess we've dropped the ball on releasing a
timely FWN report on the issue. Pity.
--
Oisin Feeley
http://fedoraproject.org/wiki/OisinFeeley
4:37 p.m.
On Fri, 2008-08-22 at 17:25 -0400, Oisin Feeley wrote:
On Fri, 22 Aug 2008 10:00:53 -0400, "Jeffrey Tadlock"
<snip>
So, it's many hours later and no one has availed themselves of the edit
function of the wiki (except for Nicu's correction, thank you) and
nothing has gone out. I guess we've dropped the ball on releasing a
timely FWN report on the issue. Pity.
Actually, many news outlets print what they have and then issue
retractions later as needed! Don't be discouraged Oisin, FWN is still
the only news I read cover to cover every week. :-)
However, I am *NOT* going to promise you another crisis to cover next
week, OK? ;-)
--
Paul W. Frields
gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717
http://paul.frields.org/ - - http://pfrields.fedorapeople.org/
irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug
7:18 a.m.
On Fri, 22 Aug 2008 17:37:19 -0400, "Paul W. Frields"
<stickster(a)gmail.com> said:
Actually, many news outlets print what they have and then issue
retractions later as needed!
I guess "publish and be damned" might be an approach worth taking.
<snip>
However, I am *NOT* going to promise you another crisis to cover
next
week, OK? ;-)
Darn!
--
Oisin Feeley
http://fedoraproject.org/wiki/OisinFeeley
4:47 p.m.
I'm not getting 140...
On 8/23/08, Oisin Feeley <oisinfeeley(a)imapmail.org> wrote:
On Fri, 22 Aug 2008 17:37:19 -0400, "Paul W. Frields"
<stickster(a)gmail.com> said:
> Actually, many news outlets print what they have and then issue
> retractions later as needed!
I guess "publish and be damned" might be an approach worth taking.
<snip>
> However, I am *NOT* going to promise you another crisis to cover next
> week, OK? ;-)
Darn!
--
Oisin Feeley
http://fedoraproject.org/wiki/OisinFeeley
_______________________________________________
Fedora-news-list mailing list
Fedora-news-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-news-list
12:07 a.m.
On Sat, 23 Aug 2008 14:47:14 -0700, "Allen Zhu"
<allen.jaloola(a)gmail.com> said:
<RE the special issue #140>
I'm not getting 140...
Yes, sorry. That special was cancelled due to lack of agreement on how
to present the incomplete and complex information. We're resuming normal
service and publishing #140 on our regular schedule, this Monday.
Thanks for your interest.
--
Oisin Feeley
http://fedoraproject.org/wiki/OisinFeeley
8:35 a.m.
On Fri, 22 Aug 2008 18:59:24 +0530, "Rahul Sundaram"
<sundaram(a)fedoraproject.org> said:
Jeffrey Tadlock wrote:
> I would agree with removing the speculation and guesses, including
> removing the Debian thing. The DSA vs. RSA bit has some relevance as
> Fedora Contributors are needing to re-upload their SSH keys to FAS and
> DSA keys are no longer accepted to my knowledge.
Yes, however this happened sometime *before* the incident.
Great prompt feedback from everyone. Please feel free to snip out
anything deemed non-useful. I'm afraid I'm out of the loop for a few
hours, so have at it. I kind of agree with the comments arguing that
the current presentation may be muddying the waters a bit. My thinking
(while knowing nothing) was to try to get a rough historical context of
both how this incident progressed *publically* and also how other
projects have been compromised in the past. Perhaps not appropriate. So
please, slash away as desired.
Thanks to all for the rapid, smart responses
--
Oisin Feeley
http://fedoraproject.org/wiki/OisinFeeley
5724
days inactive
5727
days old
21 comments
9 participants
participants (9)
-
Allen Zhu -
Chris Tyler -
David Nalley -
Jeffrey Tadlock -
Nicu Buculei -
Oisin Feeley -
Pascal Calarco -
Paul W. Frields -
Rahul Sundaram