Linux Foundation Sites Restored 141
LinuxScribe writes "The Linux Foundation has quietly restored all of the websites it took down following the September 2011 breach that affected Linux.com and all other Foundation websites--an attack that was linked to the August 2011 breach of kernel.org. But one website won't be coming back: the Linux Developer Network, launched in 2008. Content from the site will now be hosted across all of the Linux Foundation's web properties."
Re:Not Everything (Score:5, Informative)
This is about the Linux Foundation sites, not kernel.org.
Re:Wow (Score:3, Informative)
These people already have jobs.
Also, Linux is one of the most mission-critical bits of software on the planet, used heavily in finance, internet backbones, and social networking. I'd rather they be overly cautious about bringing their sites back online, than do it hurriedly and let a backdoor exploit go undetected.
Re:What about a post mortem? (Score:5, Informative)
I strongly agree. They promised they would publish an account but so far have failed to do so. On kernel.org they wrote "We will be writing up a report on the incident in the future." but I suppose "the future" in this case translates to "never" or even "mind your own business because it's embarrassing".
They are also still using a signing key which has been publicly stated to be compromised. From http://kernel.org/signature.html [kernel.org]
"The current Linux Kernel Archives OpenPGP key is always posted here, including any revocation certificates which may be outstanding on older keys.
This signature does not guarantee that the Linux Kernel Archives master site itself has not been compromised. However, if we suffer an intrusion we will revoke the key and post information here as quickly as possible."
I find it amazing that after over 4 months this simple act of revoking the bad key has still not been carried out. Even though a signed tarball doesn't guarantee much in the end, the fact that an important organisation can publicly make such a statement and then fail to honour it is actually disgraceful. It's a demonstration of bad faith in itself, and in combination with their failure to be frank about how root was gained on multiple sites and servers, is an indication of untrustworthiness of the most uncomplicated type.
Claiming to be open and honest is in no way a satisfactory substitute for being open and honest.