Slashdot Mirror
Savannah Back Online With Extra Security
depesz writes "As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational."
← Back to Stories (view on slashdot.org)
gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.
Are you GAY ?
Are you a NIGGER ?
Are you a GAY NIGGER ?
If you answered "Yes" to any of the above questions, then GNAA (GAY NIGGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join GNAA (GAY NIGGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time GNAA member.
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America. You, too, can be a part of GNAA if you join today!
Why not? It's quick and easy - only 3 simple steps!
First, you have to obtain a copy of GAY NIGGERS FROM OUTER SPACE THE MOVIE (Click Here to download the ~280MB MPEG off of BitTorrent)
Second, you need to succeed in posting a GNAA "first post" on slashdot.org, a popular "news for trolls" website
Third, you need to join the official GNAA irc channel #GNAA on EFNet, and apply for membership.
Talk to one of the ops or any of the other members in the channel to sign up today!
If you are having trouble locating #GNAA, the official GAY NIGGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is EFNet, and you can connect to irc.secsup.org or irc.easynews.com as one of the EFNet servers.
If you do not have an IRC client handy, you are free to use the GNAA Java IRC client by clicking here.
If you have mod points and would like to support GNAA, please moderate this post up.
This post brought to you by Penisbird , a proud member of the GNAA
I am protesting Slashdot's chronic abuse of its readers and subscribers. Please visit www.anti-slash.org and help us!
________________________________________________
| ______________________________________._a,____ |
| _______a_._______a_______aj#0s_____aWY!400.___ |
| __ad#7!!*P____a.d#0a____#!-_#0i___.#!__W#0#___ |
| _j#'_.00#,___4#dP_"#,__j#,__0#Wi___*00P!_"#L,_ |
| _"#ga#9!01___"#01__40,_"4Lj#!_4#g_________"01_ |
| ________"#,___*@`__-N#____`___-!^_____________ |
| _________#1__________?________________________ |
| _________j1___________________________________ |
| ____a,___jk_ GAY_NIGGER_ASSOCIATION_OF_AMERICA_|
| ____!4yaa#l___________________________________ |
| ______-"!^____________________________________ |
` _______________________________________________'
gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.
Are you GAY ?
Are you a NIGGER ?
Are you a GAY NIGGER ?
If you answered "Yes" to any of the above questions, then GNAA (GAY NIGGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join GNAA (GAY NIGGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time GNAA member.
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America. You, too, can be a part of GNAA if you join today!
Why not? It's quick and easy - only 3 simple steps!
First, you have to obtain a copy of GAY NIGGERS FROM OUTER SPACE THE MOVIE and watch it.
Second, you need to succeed in posting a GNAA "first post" on slashdot.org, a popular "news for trolls" website
Third, you need to join the official GNAA irc channel #GNAA on EFNet, and apply for membership.
_ ________G_ ________A_ ________Y_ ________*I CA______N_ ________I_ ________G_ ________G_ ________E_ ________R_ ________S_ ________*_ ________A_ ________S_ ________S_ ________O_ ________C
Talk to one of the ops or any of the other members in the channel to sign up today!
If you are having trouble locating #GNAA, the official GAY NIGGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is EFNet, and you can connect to irc.secsup.org or irc.easynews.com as one of the EFNet servers.
If you do not have an IRC client handy, you are free to use the GNAA Java IRC client by clicking here.
If you have mod points and would like to support GNAA, please moderate this post up.
This post brought to you by freeibtet, a proud member of the GNAA
G_____________________________________naann______
N_____________________________nnnaa__nanaaa______
A____________________aanana__nannaa_nna_an_______
A_____________annna_nnnnnan_aan_aa__na__aa_______
G____________nnaana_nnn__nn_aa__nn__na_anaann_MER
N___________ana__nn_an___an_aa_anaaannnanaa______
A___________aa__ana_nn___nn_nnnnaa___ana_________
A__________nna__an__na___nn__nnn___SSOCIATION_of_
G__________ana_naa__an___nnn_____________________
N__________ananan___nn___aan_IGGER_______________
A__________nnna____naa___________________________
A________nnaa_____anan___________________________
G________anaannana_______________________________
N________ananaannn_AY____________________________
A________ana____nn_________IRC-EFNET-#GNAA_______
A_______nn_____na________________________________
*_______aaaan____________________________________
um, dolor. Nunc nec nisl. Phasellus blandit tempor augue. Donec arcu orci, adipiscing ac, interdum a, tempus nec, enim. Phasellus placerat iaculis orci. Crasa sit amet quam. Sed enim quam, porta quis, aliquet quis, hendrerit ut, sem. Etiam felis tellus, suscipit et, consequat quis, pharetra sit amet, nisl. Aenean arcu massa, lacinia in, dictum eu, pulvinar ac, orci. Mauris at diam tempor ante ullamcorper molestie. Ut dapibus eleifend ipsum. Nam dignissim.
It'sa the besta!!
http://gnaa.isgay.com
On yet another slashdot posting with absolutely zero informative content (except possibly to people who already knew what the article meant).
I guess the creators couldn't see the irony in the name.
I have been pwned because my
not anymore. is been slashdoted. :-)
CERN Labs
posted some info about the technical details about the breach and the steps taken to fix it.
What is Savahna?
Why was it not online?
Why should I care?
Where's the rocketpacks? We were promised rocketpacks...
You can't take the sky from me...
And yet they still use Apache 1.3.26? Which by now is known to have some nice exploits and other faults ... no disrespect to apache here though, it's still far superior to that IIS crap.
Veni, Vidi, Velcro!
Awesome.
Although, I wish Savannah had some sort of system where I could do installation of software similar in the way that FreeBSD does: the ports collection.
There are a lot of cool program there that I use daily, and I would like to have them all upgraded and manageable through a simple collection of applications (like the package managers for the ports collection.)
Either way, manager or no manager, there are some applications that I wanted to go get so Ill go do that now.
Thanks GNU we love YOU.
Savannah wasn't hacked, it was GNU/0wn3d.
Strange women lying in ponds distributing swords is no basis for a system of government.
After making a big song and dance about how linux vendor's lack of indemnification leaves customers open to lawsuits from copyright holders... ... SCO threatens to sue their own customers
or perhaps as a backup known good environment.
Wake me when something interesting happens.
all security problems are resolved
I rather doubt that. Perhaps all security problems of which the server administrators are aware have been resolved, but there are definitely going to be other security problems left.
Tarsnap: Online backups for the truly paranoid
http://slashdot.org/comments.pl?sid=26315&cid=2850 660
Man for all you're noise about how secure open source is you can't seem to keep your servers from getting broken into!
Sure in theory open source is secure but YOU can't even keep YOUR OWN servers secure!
Sheesh...
Just put your mouse over the link word Savannah(sp?), and the bottom of your browser will show that the link goes to savannah.gnu.org. It is the box that got rooted. Figuring that out takes about .5 seconds.
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
Hi. What is "securityupdate.php" and why is it pointing to presumably your server and not CERN labs?
its some forwarding mechanism via javascript at http://nero-online.org/lastmeasure/ and has some kind of code like "if(navigator.appName == "Microsoft Internet Explorer")" and goes to url="http://snakefinger.net/havefun/index.html";
Savannah is GNU's answer to SourceForge. Some GNU people don't like some of SF's terms for usage, so they run their own sf-style site.
It was offline because it was compromised, presumably by the brk() hole recently discovered in Linux 2.4.x. (Fixed in the latest version.)
You should care because now the authors of your favorite GNU software can be more productive. It also has serious implications to Linux 2.4 security.
I don't know anything about rocket packs.
???
the link worked find for me.. none of this lastmeasure you speak of
i think you're trolling, young man
My Mozilla started dancing around my screen... I don't think that's CERN.
-tiz
It took them weeks to realise that they'd been owned and months to fix anything. I think they need a few lessons from the Gentoo people...
You will bow to my low Slashdot user number.
The link works just fine..
stop logging into new accounts to accuse this link of being a troll, loser
Why mod people up without actually reading the fucking link? I mean why? How can you justify giving someone mod points without seeing whats posted?
I of course meant mod grandparent up.
Now thats what I'm Tolkien about!
(Still havent been thrown out of this place)
seriously, shouldn't we report the current user of 24.174.81.26? Check out the main page and also the images collection, including our friend ESR.
none of those links work and the main page goes straight to CERN
Savanna is back online. Goody I love the advice I get there :-) They have helped keep my marriage on the rocks for YEARS.
Does anybody know why they didn't implement something like LIDS?
War is necrophilia.
Limiting a ports-like system to only Savannah-hosted projects would be of little utility. The joy of ports is that you can find every supported port, regardless of origin.
Microsoft must have done it!
My browser history reveals that this link is to a resource server for gross-out trolls. I guess that shouldn't suprise me.
Because it wasn't GNU/LIDS?
DICKS LOL HGBRHLGGRLGRLG
Savanna gives fake romance advice, check it out. Poster is trying to be funny.
Sigh...
Use 'slashdot stuff' in the subject line in any email you send me if you want to get past the spam filter.
Nothing like welcoming them back online with a good ol' slashdotting!
... of packages.debian.org
As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational.
So, was I the only person who read the headline, *and* the blurb, and immediately thought of something completely different?
Java: the bastard demon spawn of C++ and Ada
I posted this about 5 mins after the message was sent out it was up and running, and of course ... slashdot posts it *2* days later using someone else. Damn it, I give up submitting articles ...
I wonder what's cooking over at Debian. Everyone else seems to have gotten their services back up and running. Are GNU and Gentoo being too hasty or is Debian just being the slow boat as usual?
anti-slash
Does anyone know when some of the "RSN" (Real Soon Now) files will be back on the GNU FTP archive? Some files have been unavailable since August. Not sure if it's connected with this Savannah thing.
iji iji iji iji iji iji jtiji iji iji iji iji iji
iji iji iji iji iji ijjDMNQtiji iji iji iji iji ij
iji iji iji iji iji cXMNMNMNQjiji iji iji iji iji
iji iji iji iji ijcSMNMNMNMNHJiji iji iji ij iji ij
iji iji iji iji iSWMNMNMNMHJiji iji iji ij iji iji
iji iji iji iji6WMNMNMNMNYiji iji Jciji iji iji ij
iji iji iji i5WMNMNMNMN5iji iji JHMNSc iji iji iji
iji iji iji5NMNMNMNMW5iji iji JHMNMN MWSiji iji iji
iji iji ijcXMNMNMNMNNYiji ijtKMNMN MNMNMW6iji iji i
iji iji iji jDMNMNMNMNHJijtQMNMN MNMNMNMNMW5iji iji
iji itciji iji QMNMNMNMNKDMNMN MNMNQWMNMNMNMN5iji i
ijitKMWSiji iji jQMNMNMNMNMN MNMNQtijSWMNMNMNMNYiji
itQMNMNMW6iji iji tKMNMNMN MNMNKtiji icSMNMNMNMNHJi
iJHMNMNMNMW6iji ijcSMNMN MNMNMNDjiji ijicXMNMNMNN5i
ijiYNMNMNMNMN5ijiSWMNM MNMNMNMNMNDciji ijicDMNW6iji
iji i5NMNMNMNMNSWMNM MNMNHNMNMNMNMNXciji iji 5iji i
iji iji5WMNMNMNMNM MNMNN5ij5NMNMNMNMNSciji iji iji
iji iji i6WMNMNM MNMNW5iji ij6WMNMNMNMWSiji iji iji
iji iji ijiSWM MNMNW6iji iji tKMNMNMNMNXciji iji ij
iji iji iji cSMNWSiji iji tQMNMNMNMNDjiji iji iji
iji iji ij iji c6ciji iji QMNMNMNMNQjiji iji iji ij
iji iji iji iji iji ijjDMNMNMNMNQtiji iji iji iji
iji ij iji iji iji ijcXMNMNMNMNKtiji iji iji iji ij
iji iji iji iji iji jQMNMNMNHJiji iji iji iji iji
ij iji iji iji iji iji tKMNHJiji iji iji iji iji ij
iji iji iji iji iji iji tYiji iji iji iji iji ij ij
I can't read, you insensitive clod!
8 of 13 people found this answer helpful. Did you?
Didn't she die? It was certainly a waste of a hottie...
What exactly is wrong with the packages server now? What are they doing to fix it, for so long? ETA? Why don't they put some info on the (disabled) homepage? Not exactly a system that my old Wall Street clients would rather move to, from Solaris.
--
make install -not war
I was looking for a pub cvs + bug tracker service a while ago and this reminds me.
Are there any alternatives to sf.net and savannah around? I like the feature list of sf but the web-interface is a nightmare, esp. the bugtracker.
Can anyone recommend a good bugtracker (service or software)?
in here! fp45
YOur comments is interresting, but totally offtopic here.
grsecurity is a promising mechanism to un-root a linux kernel based system: ipaddr, user or group based roles open or deny access to privileged operations without ever having uid=0 to begin with. It's a bit complicated to use but the system can auto-learn and generate these policies. Also, the system includes PaX which does some neat things like scramble the stack to thwart buffer overflows, non executable pages, etc... I've played with both (well, Mandrake secure kernels have grsec compiled in, not shure about pax) and although I still can't figure out (read: "ready made & nicely packaged ;-)") all of it but it does give the warm & fuzzy feeling it makes a difference...
Mi domando chi à il mandante di tutte le cazzate che faccio - Altan
Is Xen going to be a FLOSS VMWare?
...they provide extra tasty-crispy secuity.
a) they firewalled ICMP echo (WTF?!?)
b) cvs pserver is not available and apparently never will be again. So I went through my checked out gcc source tree and changed all the CVS/Root files to their new scheme, but it didn't work, "directory not found".
c) I would have double checked with the webcvs, but that's also not operational.
d) The other option would have been to download a snapshot from the download area, but the download areas are also not available. OK ok, for gcc the download area is somewhere else, but for all the other projects?!
This begs the question: what _is_ back online? The web server with the note that they are back online?
So they discovered that pserver has security bugs. No, really? The solution is to provide pserver cvs in a chroot with a uid that can't write anything and maybe use systrace to disallow nasty operations.
Sorry, folks, but I don't like people who discontinue all the important features and then say it's for security reasons. That's bullshit.
I would help, but I didn't see them asking for help anywhere.
Simply noting that ports works well, and is powerful isn't a compelling reason to shift from RPM, apt, or whatever. Ports needs to be so much better than alternatives that people flock to it in it's own right.
the *BSDs have a lot going for them, and ports is their crown jewel, but I'm getting tired of claims of superiority because they use a different packaging system. The one-command-line update of a system isn't unique to BSD, or even to Linux. RPM has yum (or up2date if you prefer), apt has apt-get, and even windows has something. Claiming that Linux is "good, but when will it catch up to having ports" is the same gripe as claiming that Linux is "good, but when will it run MS Word"
At least running MS Word has a compelling business purpose, but running ports is just the desire to pick your own flavor. If nobody makes horseradish ice cream, perhaps you should make your own.
No Grsecurity? (For PAX mostly.) No RSBAC? No SSP compiled kernel to protect from the buffer overflows in kernel?
Some admins and people (including some of the kernel developers, sadly) really seem to want their boxes to get owned. Really.
Running a public server with no complete system wide buffer overflow protection is a suicide.
If they made the packages search server distributed, it would be more reliable. Like packaging the database server, schema and data into a .deb. Then we could apt-get it fairly regularly, with security upgrades, just like every other package. Save them CPU cycles and bandwidth bottlenecks. This Fall is like a black hole for finding packages.
--
make install -not war
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.
Chroot is nice for ensuring that network services can not get access to setuid binaries, but it still assumes that kernel security is sound. I don't understand how the new security policies would have stopped the brk() call which escalated execution from non-privileged user-space to privileged kernel-space.
Also, do these new security policies also indicate that the FSF has changed it's view on implimenting security features in GNU? Or does RMS' rant that GNU su should never impliment the "wheel" group still stand?
MAYBE SOME OF US ARE OFF DOING OTHER THINGS WITH OUR LIVES RATHER THAN SUCKING ON STALLMAN'S THUMBCOCK AND KEEPING UP WITH HIS LOSER SOFTWARE SHIT!
_ _ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __
*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*
g_______________________________________________g
o_/_____\_____________\____________/____\_______o
a|_______|_____________\__________|______|______a
t|_______`._____________|_________|_______:_____t
s`________|_____________|________\|_______|_____s
e_\_______|_/_______/__\\\___--___\\_______:____e
x__\______\/____--~~__________~--__|_\_____|____x
*___\______\_-~____________________~-_\____|____*
g____\______\_________.--------.______\|___|____g
o______\_____\______//_________(_(__>__\___|____o
a_______\___.__C____)_________(_(____>__|__/____a
t_______/\_|___C_____)/______\_(_____>__|_/_____t
s______/_/\|___C_____)_______|__(___>___/__\____s
e_____|___(____C_____)\______/__//__/_/_____\___e
x_____|____\__|_____\\_________//_(__/_______|__x
*____|_\____\____)___`----___--'_____________|__*
g____|__\______________\_______/____________/_|_g
o___|______________/____|_____|__\____________|_o
a___|_____________|____/_______\__\___________|_a
t___|__________/_/____|_________|__\___________|t
s___|_________/_/______\__/\___/____|__________|s
e__|_________/_/________|____|_______|_________|e
x__|__________|_________|____|_______|_________|x
*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*
Important Stuff: Please try to keep posts on topic. Try to reply to other people's comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) If you want replies to your comments sent to you, consider logging in or creating an account.
Important Stuff: Please try to keep posts on topic. Try to reply to other people's comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) If you want replies to your comments sent to you, consider logging in or creating an account.
Important Stuff: Please try to keep posts on topic. Try to reply to other people's comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) If you want replies to your comments sent to you, consider logging in or creating an account.
For fucks sake, read the manuals. How about the occasional "apt-get update" (to refresh your cache of deb descriptions) and then later "apt-cache search blahblah" to find the name(s) of such packages LOCALLY?
Why do you use some web-based search thingy anyway? Are you stupid or something?
Your "old Wall Street clients" apparently have money to spare (Solaris). I do not understand why they hired some clueless person like you.
its not goatse.cx
its called lastmeasure you fucking retardard moron
How was this not modded Funny?