Slashdot Mirror
Savannah Back Online With Extra Security
depesz writes "As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational."
← Back to Stories (view on slashdot.org)
On yet another slashdot posting with absolutely zero informative content (except possibly to people who already knew what the article meant).
not anymore. is been slashdoted. :-)
What is Savahna?
Why was it not online?
Why should I care?
Where's the rocketpacks? We were promised rocketpacks...
You can't take the sky from me...
And yet they still use Apache 1.3.26? Which by now is known to have some nice exploits and other faults ... no disrespect to apache here though, it's still far superior to that IIS crap.
Veni, Vidi, Velcro!
Awesome.
Although, I wish Savannah had some sort of system where I could do installation of software similar in the way that FreeBSD does: the ports collection.
There are a lot of cool program there that I use daily, and I would like to have them all upgraded and manageable through a simple collection of applications (like the package managers for the ports collection.)
Either way, manager or no manager, there are some applications that I wanted to go get so Ill go do that now.
Thanks GNU we love YOU.
Savannah wasn't hacked, it was GNU/0wn3d.
Strange women lying in ponds distributing swords is no basis for a system of government.
or perhaps as a backup known good environment.
all security problems are resolved
I rather doubt that. Perhaps all security problems of which the server administrators are aware have been resolved, but there are definitely going to be other security problems left.
Tarsnap: Online backups for the truly paranoid
its some forwarding mechanism via javascript at http://nero-online.org/lastmeasure/ and has some kind of code like "if(navigator.appName == "Microsoft Internet Explorer")" and goes to url="http://snakefinger.net/havefun/index.html";
Savannah is GNU's answer to SourceForge. Some GNU people don't like some of SF's terms for usage, so they run their own sf-style site.
It was offline because it was compromised, presumably by the brk() hole recently discovered in Linux 2.4.x. (Fixed in the latest version.)
You should care because now the authors of your favorite GNU software can be more productive. It also has serious implications to Linux 2.4 security.
I don't know anything about rocket packs.
It took them weeks to realise that they'd been owned and months to fix anything. I think they need a few lessons from the Gentoo people...
Don't bother, clicking the link, No CERN there, its just Goat Sex Man again.
Drunkeness is an electron free version of virtual reality.
Why mod people up without actually reading the fucking link? I mean why? How can you justify giving someone mod points without seeing whats posted?
The + mod points were given before the redirection on the site was changed.
1. What is Savannah?
2. What was the security problems?
3. Why should I or Developers care about this?
4. Why was it down for several weeks?
Not something that can be answered with moving a mouse around and 1/2 a second.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Does anybody know why they didn't implement something like LIDS?
War is necrophilia.
Limiting a ports-like system to only Savannah-hosted projects would be of little utility. The joy of ports is that you can find every supported port, regardless of origin.
Sigh...
Use 'slashdot stuff' in the subject line in any email you send me if you want to get past the spam filter.
Nothing like welcoming them back online with a good ol' slashdotting!
... of packages.debian.org
As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational.
So, was I the only person who read the headline, *and* the blurb, and immediately thought of something completely different?
Java: the bastard demon spawn of C++ and Ada
I wonder what's cooking over at Debian. Everyone else seems to have gotten their services back up and running. Are GNU and Gentoo being too hasty or is Debian just being the slow boat as usual?
Does anyone know when some of the "RSN" (Real Soon Now) files will be back on the GNU FTP archive? Some files have been unavailable since August. Not sure if it's connected with this Savannah thing.
What exactly is wrong with the packages server now? What are they doing to fix it, for so long? ETA? Why don't they put some info on the (disabled) homepage? Not exactly a system that my old Wall Street clients would rather move to, from Solaris.
--
make install -not war
I was looking for a pub cvs + bug tracker service a while ago and this reminds me.
Are there any alternatives to sf.net and savannah around? I like the feature list of sf but the web-interface is a nightmare, esp. the bugtracker.
Can anyone recommend a good bugtracker (service or software)?
grsecurity is a promising mechanism to un-root a linux kernel based system: ipaddr, user or group based roles open or deny access to privileged operations without ever having uid=0 to begin with. It's a bit complicated to use but the system can auto-learn and generate these policies. Also, the system includes PaX which does some neat things like scramble the stack to thwart buffer overflows, non executable pages, etc... I've played with both (well, Mandrake secure kernels have grsec compiled in, not shure about pax) and although I still can't figure out (read: "ready made & nicely packaged ;-)") all of it but it does give the warm & fuzzy feeling it makes a difference...
Mi domando chi à il mandante di tutte le cazzate che faccio - Altan
Is Xen going to be a FLOSS VMWare?
...they provide extra tasty-crispy secuity.
a) they firewalled ICMP echo (WTF?!?)
b) cvs pserver is not available and apparently never will be again. So I went through my checked out gcc source tree and changed all the CVS/Root files to their new scheme, but it didn't work, "directory not found".
c) I would have double checked with the webcvs, but that's also not operational.
d) The other option would have been to download a snapshot from the download area, but the download areas are also not available. OK ok, for gcc the download area is somewhere else, but for all the other projects?!
This begs the question: what _is_ back online? The web server with the note that they are back online?
So they discovered that pserver has security bugs. No, really? The solution is to provide pserver cvs in a chroot with a uid that can't write anything and maybe use systrace to disallow nasty operations.
Sorry, folks, but I don't like people who discontinue all the important features and then say it's for security reasons. That's bullshit.
I would help, but I didn't see them asking for help anywhere.
Simply noting that ports works well, and is powerful isn't a compelling reason to shift from RPM, apt, or whatever. Ports needs to be so much better than alternatives that people flock to it in it's own right.
the *BSDs have a lot going for them, and ports is their crown jewel, but I'm getting tired of claims of superiority because they use a different packaging system. The one-command-line update of a system isn't unique to BSD, or even to Linux. RPM has yum (or up2date if you prefer), apt has apt-get, and even windows has something. Claiming that Linux is "good, but when will it catch up to having ports" is the same gripe as claiming that Linux is "good, but when will it run MS Word"
At least running MS Word has a compelling business purpose, but running ports is just the desire to pick your own flavor. If nobody makes horseradish ice cream, perhaps you should make your own.
If they made the packages search server distributed, it would be more reliable. Like packaging the database server, schema and data into a .deb. Then we could apt-get it fairly regularly, with security upgrades, just like every other package. Save them CPU cycles and bandwidth bottlenecks. This Fall is like a black hole for finding packages.
--
make install -not war
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.
However, it can be answered by clicking the fucking link.
Wall Street has money to spare on doing it productively. When you get into junior high school, foolish Anonymous Coward, you'll meet some people who know how to *work together*, instead of always doing everything for themselves from scratch. Until you learn to play nicely, don't expect the clueful like me to even bother to school you.
--
make install -not war