On Sun, 2008-08-24 at 16:55 -0500, Bruno Wolff III wrote: > On Sun, Aug 24, 2008 at 12:46:59 -0500, > Thomas Cameron <thomas.cameron@xxxxxxxxxxxxxxx> wrote: > > > > is foolish and irresponsible to announce anything about that breach. Had > > Paul said "Hey all, we've gotten hacked and we don't know how badly or > > how they got in or what the damage is" he'd have been eaten alive, and > > rightly so. Instead he took a very reasonable approach, apparently > > In your opinion? It seems like many of the people in this thread would > have liked him to have said something to that effect in the first > message. That was not going to damage any ongoing investigation Prove it. Tell me about *your* experience recovering from security breached. Tell me about how *you've* interfaced with law enforcement in those cases. Tell me about *your* experience with corporate requirements for recovery from such a breach. Tell me about *your* process and how it has been vetted by *your* legal department so that all interests - corporate, law enforcement and lastly community - are protected. Now take all of that and throw it away, because the vetting process that the Fedora project has to go through is more than likely very different from yours. > as shutting > down the servers was going to tip their hand in any case. It would have > given the community some information to act (or not) on. In this case, the desires (and these are simply desires, not needs) of the community are rightly secondary to the legal requirements of the Fedora project, a project funded by a US corporation. The folks who spew about "woulda shoulda coulda" are in pretty much every case showing their asses here. It's painfully obvious that they've never been through this kind of exercise. I have. I understand that the path to recovery from this kind of breach is incredibly painful, and there are numerous folks managing that recovery. Satisfying all of the stakeholders is pretty much impossible. To blithely coach and criticize from your armchair is the height of hubris. Leave it to the professionals who run the Fedora infrastructure, they actually know what they are doing. -- Thomas -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
