A response to "The Fedora-Red Hat Crisis"

Bruce said that Red Hat / Fedora left the users vulnerable. How so? While it is true that Fedora's updates were delayed during the period of time it took them to get to the new signing key process... and to get all of the old updates resigned with the new key... and the repositories synced across all of the mirrors... the users were never at risk as a result of the initial situation. I commend the warning made in the initial Fedora announcement about being wary of updates. It turns out that there was not a package threat so the initial warning was overkill... but they didn't know that at the time because their own internal assessment of the situation was ongoing.

I commend Fedora for releasing information to the users before they were completely sure of the situation. That is very much an indicator that the situation was not handled in a CYA corporate manner.

Standard practice for most proprietary software vendors is to say nothing until an issue finds its way into the press somehow... and then only respond with the minimal amount of information possible... usually denying everything until it can no longer be denied. That CERTAINLY WAS NOT the case with Red Hat / Fedora. They were out early with information... so early it was incomplete... and they did it of their own accord rather than as a mandatory response to some third party.

Full Story