@dangoodin @triskelion Dan, thank you for following up. I do not speak for the Linux Foundation, so I cannot address any of the items you highlighted in any official way. However, two important facts to keep in mind: 1) at the time of the break-in,
k.org infrastructure was NOT managed by LF. It was managed by a team of volunteers from the kernel development community. LF only took the stewardship of
k.org infrastructure several months after the incident. I believe I was the first actual LF employee to get access to
k.org infrastructure, and that was in November of 2011, when I started at the Foundation. 2) the findings in the paper about "2 years" were as new to me as to everyone else, and I have no idea about the source on which they base this claim. I believe that all hardware involved in the compromise was turned over to the FBI as part of the investigation and I didn't get to touch any of it -- physically or otherwise.
For the transparency aspect of things, I want to direct you to my talk I gave to the Linux Security Summit last year:
https://youtu.be/K3SVt1WCheY?si=KbbCWTGCypfFTdSyIn it, I go over a lot of things, including how we try to make ourselves more resilient to any repeat compromises, should they happen (or if they already have and we just don't know it yet).
HTH.