It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Community
General discussionLinux distro hacked on GitHub, “all code considered compromised”(9 posts)(9 posts)
(9 posts)
Pages:
1
This is my favourite topic
Posted June 30, 2018
I'm just providing this link as a public service as I know that many members here like and use Linux and may wish to know of this news. Let's keep everything civil and not turn this thread into a war. Thank you, have a nice day.

https://nakedsecurity.sophos.com/2018/06/29/linux-distro-hacked-on-github-all-code-considered-compromised/
Posted June 30, 2018
avatar
TARFU: I'm just providing this link as a public service as I know that many members here like and use Linux and may wish to know of this news. Let's keep everything civil and not turn this thread into a war. Thank you, have a nice day.

https://nakedsecurity.sophos.com/2018/06/29/linux-distro-hacked-on-github-all-code-considered-compromised/
From your own link:
· The Gentoo team didn’t beat around the bush, and quickly published an unequivocal statement about the breach.
· The Gentoo GitHub repository is only a secondary copy of the main Gentoo source code.
· The main Gentoo repository is intact.
· All changes in the main Gentoo repository are digitally signed and can therefore be verified.
· As far as we know, the main Gentoo signing key is safe, so the digital signatures are reliable.
Plus, I've never tried Gentoo, but my guess is that not many of its users would obtain it and compile it from GitHub. Then again, it's Gentoo users we're talking about... xD


PS: Is GitHub already in Microsoft's hands, or the acquisition hasn't taken place yet? :P
Posted June 30, 2018
Linux distro = Gentoo
Posted June 30, 2018
avatar
TARFU: I'm just providing this link as a public service as I know that many members here like and use Linux and may wish to know of this news. Let's keep everything civil and not turn this thread into a war. Thank you, have a nice day.

https://nakedsecurity.sophos.com/2018/06/29/linux-distro-hacked-on-github-all-code-considered-compromised/
avatar
muntdefems: From your own link:

· The Gentoo team didn’t beat around the bush, and quickly published an unequivocal statement about the breach.
· The Gentoo GitHub repository is only a secondary copy of the main Gentoo source code.
· The main Gentoo repository is intact.
· All changes in the main Gentoo repository are digitally signed and can therefore be verified.
· As far as we know, the main Gentoo signing key is safe, so the digital signatures are reliable.
avatar
muntdefems: Plus, I've never tried Gentoo, but my guess is that not many of its users would obtain it and compile it from GitHub. Then again, it's Gentoo users we're talking about... xD

PS: Is GitHub already in Microsoft's hands, or the acquisition hasn't taken place yet? :P
I simply did a direct cut and paste of the article's headline and the link leading to the article. I do not use Linux or claim to be an expert on it, I only wanted to let our many Linux users here know about it in case they might be affected.
Posted June 30, 2018
What interests me is how the breach / change is done in the first place and no explanation for that on the article.

Normally people have to fork a github repo, make change and re-upload. It all requires valid github login and approvement from project manager. I'm curious if they found a backdoor or anything like it in github
Posted June 30, 2018
Few lucky I didn't download it TY TARFU

oh and +1
Post edited June 30, 2018 by fr33kSh0w2012
Posted June 30, 2018
Whatever. I use gentoo, and this is the least of my current distro-related concerns. I prefer lwn.net for Linux-related news and informed discussion over gog.com. Never even heard of nakesecurity.sophos.com, and don't care.
Post edited June 30, 2018 by darktjm
Posted June 30, 2018
Ah, Gentoo. One of the more whacked up distros anyway.

And nothing of value was lost.
Posted June 30, 2018
avatar
kusumahendra: What interests me is how the breach / change is done in the first place and no explanation for that on the article.
it seems one account was compromised (probably password stolen ??). as things happen most of the time.
no need to hack the infrastructure, just find a user who isn't careful enough about his personal security.

By the changes done by the attackers you can probably guess that some dumb script kiddys from 4chan did this for the lolz, ie it is not an sophisticated attack.
avatar
muntdefems: PS: Is GitHub already in Microsoft's hands, or the acquisition hasn't taken place yet? :P
the acquisition is done by the end of the calendar year I think, so we probably have to dismiss this nice conspiracy theory ;)
Post edited June 30, 2018 by immi101
Pages:
1
This is my favourite topic
Community
General discussionLinux distro hacked on GitHub, “all code considered compromised”(9 posts)(9 posts)
(9 posts)