Re: Security incident on Fedora infrastructure on 23 Jan 2011

2011-01-27 Thread Paul W. Frields
On Thu, Jan 27, 2011 at 01:35:05AM +0530, Rahul Sundaram wrote: On 01/27/2011 01:12 AM, Paul W. Frields wrote: On Wed, Jan 26, 2011 at 09:30:24AM -0700, Kevin Fenzi wrote: Disappointingly the slashdot story paraphrased another site that went with a sensationalized headline and was low on

Re: Security incident on Fedora infrastructure on 23 Jan 2011

2011-01-26 Thread Kevin Fenzi
On Wed, 26 Jan 2011 15:25:40 +1300 Al Reay alre...@gmail.com wrote: Looks like it's made the news http://news.slashdot.org/story/11/01/25/1723259/Fedora-Infrastructure-Compromised Disappointingly the slashdot story paraphrased another site that went with a sensationalized headline and was

Re: Security incident on Fedora infrastructure on 23 Jan 2011

2011-01-26 Thread Paul W. Frields
On Wed, Jan 26, 2011 at 09:30:24AM -0700, Kevin Fenzi wrote: On Wed, 26 Jan 2011 15:25:40 +1300 Al Reay alre...@gmail.com wrote: Looks like it's made the news http://news.slashdot.org/story/11/01/25/1723259/Fedora-Infrastructure-Compromised Disappointingly the slashdot story

Re: Security incident on Fedora infrastructure on 23 Jan 2011

2011-01-26 Thread Rahul Sundaram
On 01/27/2011 01:12 AM, Paul W. Frields wrote: On Wed, Jan 26, 2011 at 09:30:24AM -0700, Kevin Fenzi wrote: Disappointingly the slashdot story paraphrased another site that went with a sensationalized headline and was low on facts. They didn't even point to the actual announcement for folks

Re: Security incident on Fedora infrastructure on 23 Jan 2011

2011-01-25 Thread Ricky Zhou
On 2011-01-25 10:50:48 PM, Till Maas wrote: Did he really not have write access to the Fedora wiki or the different trac instances (wiki, ticket system) on fedorahosted? I am not sure how it is handled, but he also might have had push access to the comps repo on fedorahosted. Sorry, these are

Re: Security incident on Fedora infrastructure on 23 Jan 2011

2011-01-25 Thread Kevin Fenzi
On Tue, 25 Jan 2011 17:10:20 -0500 Ricky Zhou ri...@fedoraproject.org wrote: Additionally it would be nice to investigate whether the account was used to access the test machine resources for package maintainers: https://fedoraproject.org/wiki/Test_Machine_Resources_For_Package_Maintainers