The Red Hat-supported Fedora Project has started issuing updates to its Linux distribution again, after a hiatus of several weeks caused by a hacker break-in. Late yesterday, Fedora emailed its users to let them know that it would soon issue updates for its most recent Fedora 8 and 9 operating systems.
Post a Comment
Member since:
2007-07-20
Member since:2006-05-14
Pretty simple actually, they sent an email to fedora-announce-list@redhat.com.
The announcement is here:
https://www.redhat.com/archives/fedora-announce-list/2008-September/...
Member since:
2006-07-14
From what I make of it, a GPG key was compromised, so they have to transition to a new one. In order to do that, they are asking their users to trust the compromised key one more time.
Isn't that a golden opportunity for whoever stole the key to inflict further damage?
Plus, all Malory needs to do is intercept the new key and replace it with his own and use it to sign malicious updates with it.
If I'm missing some key detail that makes all of the above mute please let me know.
Member since:2005-07-06
Isn't that a golden opportunity for whoever stole the key to inflict further damage?
That compromised key is useless given the fact Fedora infrastructure already generated a new version. That cracker would have to pretend to be fedora-announce-list but that will put him/her on criminal action.
https://www.redhat.com/archives/fedora-announce-list/2008-September/...
Member since:2006-07-14
Member since:2007-09-22
Member since:2005-07-06
The project does not believe that the keys are compromised. Neverthless, it is being changed as a precautionary measure. The couple of transitionary packages are still signed with the old key since Fedora does not allow unsigned packages by default and then everything from then onwards will use the new key.
Member since:2005-11-12
