4 ms·
I'm trying to imagine this happening to someone like Red Hat. BM: "We have the keys to your software repos give us money or we leak." RH: "Here's a tarball of
by hyperion2010 12y ago
I'm trying to imagine this happening to someone like Red Hat.
BM: "We have the keys to your software repos give us money or we leak."
RH: "Here's a tarball of the sources it make your life easier, knock yourselves out! Maybe we'll even get some new developers!"
Obviously there are reason's why companies choose to keep their software closed source, but sometimes I wonder.
- tzs 12y agoThe article is a bit unclear, but it appears that what the blackmailers got were the signing keys for the software. Losing signing keys would be pretty bad for Red Hat, too.
- 0x0 12y agoThat happened! And that was also 6 years ago. http://linux.slashdot.org/story/08/08/22/1341247/red-hat-fedora-servers-compromised http://linux.slashdot.org/story/08/08/22/1341247/red-hat-fed...
- porpoisemonkey 12y agoI think the analogy is a little off. This would be like someone having the GPG signing key for the Red Hat official repositories. It would give them the ability to insert their own (malicious) software package into the Red Hat update stream without the signature throwing any warnings.
- hyperion2010 12y agoIsn't that why we keep revocation certs around? That doesn't really work for blackmail anyway because it is dependent on preventing the organization from knowing that you have access.
- rplnt 12y agoWell, RH isn't the best example. IIRC they do some shenanigans around kernel updates to hide the actual patches. And only paying customers get it.
- dredmorbius 12y agoI was going to make a similar post suggesting Google/Android. It's one class of business risk avoided.