Slashdot Mirror
Gnome.org Compromised?
Garden GNOME writes "The GNOME sysadmin team has just announced that the main GNOME web server has probably been intruded into, leading to the shutdown of the GNOME website, (including bugzilla.gnome.org, art.gnome.org and developer.gnome.org). The GNOME mailing lists, and CVS servers seem to be up, though the FTP server was immediately taken down as a precautionary measure (released sources are believed to be intact). This is bad, because GNOME 2.6 was supposed to be released tomorrow. Let's hope it is a false alarm."
...woulda been uncrackable.
Spread the RC luvin'
I guess the next version of longhorn will now look like GNOME.
Damn you KDE zealots!! Let us have our release!
Who left the key under the mat?
Does anyone know anything else about how this was done? What exactely was comprimised? The word "comprimised" has a braud meaning, more information would be interesting.
Sucks, I was just going to go to art.gnome.org
Shouldn't that read Gnome.org Kompromised? No, no, that's KDE. It should read Gnome.org Gnompromised.
This has got to be the work of those KDE bastards!
I read on an irc channel that this was in response to Miguel insistence to use .NOT for gnome.
The GNOME sysadmin team
23 March 2003
Oh come on, someone find a dupe, hurry!
The Slashbots will point blame at the admins. However, if it were Microsoft...
Am I the only one who started picturing little lawn ornament men being caught in embarrassing positions?
Shades of Toy story....
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
I wonder if they have CRC'd the source and bins yet? Christ, who attacks OPEN SOURCE? Oh....heh.
Well...I suppose that if this is a new vulnerability, it's better that they go after a high-profile webserver with a good admin team that can catch the attack than that they attack many poorly-adminned ones.
May we never see th
We've discovered evidence of an intrusion on the server
hosting www.gnome.org and other gnome.org websites.
At the present time, we think that the released gnome
sources and the gnome source code repository are unaffected.
We are investigating further and will provide updates
as we know more. We hope to have the essential services
hosted on the affected machine up and running again as soon
as possible.
The GNOME sysadmin team
23 March 2003
if Linux boxes were not attacked security would not be as good. Look at this in a positive manner. At least on Linux the problem will be remedied within hours and life goes on.
... if they weren't using an insecure OS like Windows for all their development work.
At least they caught it now, instead of after the release. Now the code can be checked before it goes out, instead of everyone worrying about whether they downloaded compromised code
uhm, check ask slashdot a few days ago. someone actually asked that same question, got some good replys.
(yes i know you're joking, this is just so people know i am too)
compromised you'd all be laughing your asses off. Gee, I thought all this Open Source stuff was supposed to be secure!
A Compromised Gnome. The image is just wrong.
Maybe this will turn out to be a non-event
but, in general, the development community
is a very tempting target.
Actually, breakins are crude. Subtley malicious
code is the sophisticated approach.
Well I Hope it is a good wake up call to some of those people who are running the server. That it doesn't matter what OS they are running that they still need to take security seriously. Unfortunately this can make Linux look bad with a lot of eyes on the Gnome for desktop Linux having a security breach can make a lot of people skeptable of taking the time to switch to an other OS if they figure that one is just as insecure as the other. If it was some Script Kiddies little Linux box that got hacked we can go well he probably didn't configure properly or turned off the security on it to make administration easier. But with something as visible as the Gnome project you need to be more careful and put a little more time in administration the system right.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
...Gnot today.
It's a bit disappointing that somebody was able to compromise their gnetwork, but i guess gno system can be comletely secure. I only hope people would stop putting G's in front of all the N words they use when they're talking about Gnome. It's getting on my gnerves.
Esoteric reference.
It may have been the GLF. They've been causing problems in europe..
Now the internet? Guess I'm not the only one waiting for the new release!
FREE THE GNOME!!!
But, just like in previous break-ins to other systems (Gentoo, Debian, Savannah), they're taking the correct actions by shutting everything down and BEING CAREFUL. I often wonder if commercial companies are always this fastidious.
:)
You can't beat all the crackers, but handling a bad situation correctly should be commended. Good job, GNOME team!
I'm eagerly awaiting 2.6, too, I may add!
-Erwos
Plausible conjecture should not be misrepresented as proof positive.
Oh my God! I hope they didn't steal any source code!!
Why can't the crackers leave the good guys alone?
:(
I've come to the conclusion that the "crackers" see no one as the good guys. There are 10 types of systems to them: "Victims and Potential Victims."
They give us other sociopaths a really bad name.
A backup is useless if you are not sure of its integrity.
Project behind in the programming? Have a 'break-in' and push off release indefinitly. Worked for the Half-life 2 team.
In all seriousness, however, it would not be good if they did have a break in, as this is a very large, popular project.
-CPM
---You're all I need, When the water runs deep, You're all I need, Now I cry my soul to sleep -- Collective Soul, Needs
someone trying to change the File DIalog for one that doesn't suck
MOHAWK DAN: LOL D00DS IM IN
sLiPkNoT696969: omg d00d hax0rs them
p1kap1ka: hahaha pwnage u go d00d what proxy r u using
MOHAWK DAN: WHATS A PROXY LOL
p1kap1ka: uh... it hikes ur ip
MOHAWK DAN: LOL WHATS AN IP TELL ME NOW THAT IM A HAX0R
---
Never criticize religion on Slashdot. You will be modded down for "Troll" no matter how factual it is.
Now I'm waiting for you smartasses to come up and say "it's Microsoft's fault"
heh
Maybe someone desperately wanted a copy of the original Open Source Gnome LOGO!
Besides what would one get out of breaking into an open source server.Source code thats already available? try to corrupt that? Not a good plan.
Lord of the Binges.
...
I hear these hackers are going to release the source
http://www.nbr.co.nz/home/column_article.asp?id=85 76&cid=3&cname=Technology
Enough said if you read that article.
Last years distro of Linux from any major vendor required three times as many downloads and many more megabits than any previous windows version ever and that's not counting the time wasted keeping up with all this shit.
But this will get modded down to hell won't it.
So what if it isn't released tomorrow? I would rather have a code that works than worry about a compromise. If only Microsoft would learn from this. Then again, they have Updates (aka bug fixes)
-- johntracy.com, because everybody else is wrong.
Imagine a beowulf cluster of compromised gnome servers.
Gnomdor has fallen to the dark forces of Redmond. The Dark Lord grows in power and sends forth his armies to conquer Linux_land.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
So although I may get the -1, troll treatment, I actually feel glad that someone understands my frustration with GNOME! I'm sticking with kde 3.2!
they're going to get the source code!!! i do hope this doesn't affect the release of gnome 2.6 though. i can't wait to see gnomes vision of a spatial file manager
In the next episode of the broken your stalwart hosts will feature a story on how to compromise an OSS project's webserver!
Obviously, since gnome is a GNU/linux cornerstone, it must be coming from sco. Go get'em, feds!
(logic used: same as in "sco.com was attacked by a worm -> it must have been a linux fan")
"It's too bad that stupidity isn't painful." - Anton LaVey
do you feel that linux is weak enough for a windows script kiddie to hack?
That's the wrong attitude to take. If a Linux-based server is compromised because of software flaws, that's a perfectly legitimate point in an argument about security, just as the compromise of a Windows-based server because of a software flaw would be. If there's a real vulnerability that let somebody crack the system (as opposed to a misconfiguration or incorrect belief that the system was broken into) it needs to be fixed pronto, rather than written off as a PR event.
There's no point in questioning authority if you aren't going to listen to the answers.
Now everybody can look at the code and find exploits...
oh wait....
http://mail.gnome.org/archives/gnome-hackers/2004- March/msg00016.html
my website, www.employmentcenter.reidsystems.com was compromised as well, is it coincidental or what?
mod up please!
...as those cybersquatters sitting on gnomefoundation.org a few years back, and redirecting it to KDE!
You know...honestly...
There have been serveral major, high profile compromises of numerous FOSS servers in the past twelve months. Including a compromise of the GNU source repository.
Microsoft has not made a big deal out of these (at least as far as I've seen). Whereas every security flaw at Microsoft is treated by Slashdot as if someone got access to the crown jewels (well, admittedly the Windows source is running around all over the place...)
Microsoft has really been acting a lot nicer towards FOSS folks about security lapses.
That being said, I'm just *waiting* for a sourceforge compromise. That would be a *huge* hit, and it just plain has to happen sooner or later.
It would be nice if a couple of distributions put out basic *up-to-date* HOWTOs of best practices on how to set up minimal, secure servers using their distribution.
May we never see th
How can we pin the blame on Microsoft? Dooooo +p.
You can't compare a Linux distribution with hundreds of packages to Windows, which is basically a kernel/GUI/browser combo.
Try using (for Linux) the number of kernel/X11/Mozilla vulnerabilities instead and at least you'll start making sense.
And at the end of all the downloads and patching, which was the more secure?
Just out of interest...
Security through immaturity is not viable.
Netcraft sez that it runs/ran Redhat Linux, so it must be Redhat's fault!
What? Me? Of course, I looovve Redhat!
Given that the article does not specify what method was used to compromise the servers, speculation of a flaw in Gnome is absolutely relevant and appropriate.
+1 Informative, dude.
The GNOME mailing lists... seem to be up
Well, now that you linked to mail.gnome.org on Slashdot, it won't be up for long!
I wonder how many people are downloading code from the CVS servers to check for comprimised code. Their CVS was already slow at times...
"Can of worms? The can is open... the worms are everywhere."
You make a good point. Unless they know when the security compromise happened, and the backup is not wired. Then again, what is the point of a back up if it too can be hacked?
-- johntracy.com, because everybody else is wrong.
You are a typical slashdot idiot. People don't attack other guys because they are enemy. This has been the case since the early days of the internet. You guys are really too stupid. People attack because they can, and there is always this weird satisfaction of attacking a site, being able to own it using different methods. That's the glory for most of the people who do this.
Linux probably will face more and more of these as people use Linux more often. Businesses that use Linux will have more of these as they switch to linux from Unixes.
must.. resist.. temptation to moderate...
I wonder if they are running a Debian based or Debian itself, and Debian has another hole in it.
Funny. Too bad that was just a regular kernel hole, not one special to Debian's kernel. Any other distros can simply count themselves lucky the attackers didn't choose them.
When Microsoft undergoes a security breech, their source code spills out and leaks across the entire Internet.
When gnome.org undergoes a security breech, their source code is more *difficult* to get.
Fun, eh?
May we never see th
Hey, when windows comes with half the stuff that most Linux distros ship with and install by default you might have a point; until then your argument is like comparing Apples and PCs.
Joey hacked the gibson?? o wait.. it was just the gnome server.. o.. wait.. that's even worse!
numerous tests prove longhorn to be a much more secure home desktop, while linux is better for internet webservers. however most vulnerabilites for linux were done by random. windows however were common errors.
The thing to do is backup your integrities. I mean use tripwire.
...having a security breach can make a lot of people skeptable...
Skeptable? Is that some gnomish word I'm unfamiliar with?
I fully expect a bunch of lame Microsoft jokes.
But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.
Can you honestly rail on Microsoft? When was the last time their servers were compromised? I only vaguely recall something in 2000 about alleged stolen source code, and a real good that has turned out all these years later. As for this year's stolen source code, Slashdot never reported this but it was taken from a Linux computer at MainSoft.
Just funny how things are viewed around here, with a certain bias some people don't even realize they have.
somewhere, out there, a Kracker is laughing....
David
My bad, won't happen again.
-KDE
Error 407 - No creative sig found
When ever we hear about a windows box being hacked we hear "that wouldn't happen if you ran Linux"... is it so bad to have the joke the other way around?
From Netcraft:
Apache/1.3.12 (Unix) (Red Hat/Linux) mod_ssl/2.6.4 OpenSSL/0.9.5a PHP/3.0.7
Could it have anything to do with the old version of OpenSSL, and the numerous vulns found lately?
Help! I'm going to France soon and I need to know where I can go to be insulted. I mean REALLY insulted...
The GNOME sysadmin team
23 March 2003
Gnome Gsucks.
Gno, it dogn't.
One man's -1 Flamebait is another man's +5 Funny.
...that was serving all 4 users of Gnome.
Then you enjoy contributing to Trolltech's Qt protection racket?
I didn't think so.
ssl bug? or is it the big dog, apache?
guess next you'll tell us that ASP.NET is the better plattform for web services =)
while (!asleep()) sheep++
Don't bring up the backup until you figure out how they got in.
If only because... it's better! And... I HAVE FURY!!!!
There's nothing worth stealing!!!
I'm sure it was the terrorists. They were last seen tunneling somewhere.
It was probably just slashdotted!
Security is inversely proportional to the commitment of one desiring to circumvent it.
Geez, I know the KDE folks think they're superior, but hacking your competitors website? That's so Microsoft-y.
Why cant these idiots find something else to do with their time then screw up systems. ( be it some OSS project or a commercial behemoth )
Perhaps we just need to forget the courts, and find people that do this and take care of the problem.
All it does is make everyone's life harder, it doesn't get 'them' anywhere...
Disclaimer: I'm not even a Gnome fan.. it's the principle.
---- Booth was a patriot ----
Gnome's servers were all running RedHat, between versions 7 and 9 last time I checked... they should switch those to a better maintained distro already as RH7-9 is deprecated...
Not to pick nits, but that error didn't come from ASP.Net, it is from classic ASP and is actually an ADO (data access) error.
...sorry.
The Gnome team didn't mix all the web sites (where user custom shell scripts are always a risk) with the cvs box.
Just a thought, and I haven't been around very long, but if a major software company had reason to suspect their security had been compromised the day before a major release, which is to say sometime after major effort and bucks went into promoting the release, would they publicize it?
It seems to me that since Gnome is open-source, they don't have a lot to lose by delaying the release until they know their product has not been compromised.
The Dalai Llama
Just thinking out loud, try not to get any on your shoes
My sig could be your sig!
But if we love conspiracy theories, it could be simply like that. We all know about that there really should be connection between Antivirus developers and virus writers. So, they got a serious headache about Linux coming to common user's desktop, as, if it's properly locked down by admin or service provider for that box, there's no need of any kind of antivirus in Linux (IF we are talking about desktop, mail servers which serving also Windows boxes is another story).
:) And if it is how I said so - be ready for anything, because those people doesn't want to change. They want their old market back.
So they see a danger for their market. What they should do? Do some bad PR for open source. How? Gnome will release 2.6 in Wendsday, 24th of March? I see. Let's hack some server. REMEMBER, everything could be broken, even properly set-up OpenBSD box. So some black hat get's paid and do his dirty job. For what? Just for PR stunt - in miracle, tomorrow every main IT news site will knew about GNOME release AND possible compromise.
In summary - guys, get ready for such events to happen. It's a fight, a battle. Even if it is simple hacker who wanted to be proud what he has done - so beat it, we must be more careful about security in future
user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
Not many more people look at OSS code than propretary code in practice, and since both are written in c, both are prone to human coding error. Therefore, OSS code is no more secure than proprietary code, all else being equal.
With OSS, an intrusion, even a full bore compromise of the code base is more likely to be caught. I would hope that there are diligent OSS people that cross-compare their copies of the source to the CVS copies and look for disrepancies. A distributed analysis of all changes (including the officially sanctioned ones) would help uncover malicious code.
In contrast, the users of proprietary code have only the manufacturer's word on what changes occured, who made them, and what those changes do. We users have no easy way (short of reverse engineering the code deltas on the binaries) of determining what happened between version X and version X.1. The security of non-OSS code is in nontransparent hands and that makes it insecure.
Two wrongs don't make a right, but three lefts do.
I'd think that if tripwire came back okay, the backup to a separate tripwired enabled box would commence.
you have to take the space out of the link. slashcode adds it for some reason. without the space, it works fine.
> Don't bring up the backup until you figure out how they got in.
And when.
Hi,
I represent a security company who were asked to analyse the logs on the compromised system. All the originating IPs point to a place called Lindon, Utah in the US.
Anyone know what that means?
If windows came with SQL and Exchange server, Office suite and various other add-ons and softwares, it'll be easily as big. But that doesn't matter since you cannot download non-trial version of Windows from MS in the first place.
1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
With OSS, an intrusion, even a full bore compromise of the code base is more likely to be caught.
Naive. Cf Ken Thompson, Reflections on Trusting Trust. Unix back in those days was, at least at Bell Labs, about as OSS as it can get, and the body of code was nothing compared to today either.
Neither and that's the point.
Tommorro someone will find a vunerability in both of them.
some punk thought it would be funny to steal our newest lawn GNOME.
Lucky anyhow that the server is unavailable 'before' it got slashdotted.
This is NOT the best sig in the world, but this IS a tribute to the best sig in the world.
Here is what the devolopers should do.
Each time they submit a file that they have made changes to in the cvs archive, then also hmac it and sign it with their private key. Then later on if the system was compromized you could go back and computer the hmac of the file to make sure it matches that which the programmer submitted it to be.
And then even if the system was compromised you wouldn't have to question which ones were changed or not since it can be checked just by confirming the hmacs.
The best design for security have perfect forward security. And a signed hmac would prove the validity of the file unless the signing key was compromised.
Gnome got powned. On a more serious note, I bet it was some deranged KDE fan or something. The GUI wars have been heating lately.
There's a growing sense that even if The Future comes,
most of us won't be able to afford it.
-- Lemmy
At least as far as I been aware it never been a a OS that was at fault.
nitpicking? Well yes. But just ask yourselve this. Gnome runs Red Hat. If there was a hole in Red Hat then why is only gnome under attack and not every Red Hat box in the world? Are linux hackers more easily satisfied and think 1 box is enough?
So what do you think has happened here. Someone found a fault with Red hat or did someone find a fault with the Gnome setup of their Red Hat server?
Only fools blaim MS for users who download a "keygen" that turns out to be a virus. However we do blaim MS for making holes in their software that affects every damn installation of windows out there.
That is the difference.
As for your howto suggestion. They exist. They just are a lot of work and most people don't bother. Hell if you follow such howto's then Windows can be made secure (rule 1 Windows is not an internet OS, run it behind a firewall that means not a firewall ON windows but windows BEHIND a firewall). I follow them. My windows/dos box has never been compromised. Neither has my linux box.
Then again neither of my machines is supposed to do what gnomes machines are supposed to do. It is easy to secure to the outside world when nobody is supposed to access it. Fort Knox is secure because nobody is allowed in there. The highstreet bank is a lot harder to secure.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
until Netcraft confirms it.
I'd actaulyl think the code might have been touched. The timing of the hack is interesting because it is so close to a release. If I was going to try and plant something I'd wait until just before it goes out the door in a mssive release. Less chance of getting caught and biggest dispersal oppurtunity. Sigh
For news regarding what was compromised and HOW it was compromised. I doubt we'll ever find WHO and WHY, but here's hoping that we do.
I would like to know if it was some known exploit that the admin didn't take care of. Or some easy-to-guess password by one of the developers. Or, worse, some as-yet-unknown exploit.
Of course we want to be fair... let's blame SCO!
Guess you've not purchased a windows PC from any major vendor lately. Mine came with everything including a kitchen sink.
Basically what your saying is the linux kernel is secure and everything else is shit. If it weren't for several linux kernel vulns within the last several months that might hold some water.
That's like saying shell32 is shit because symantec coded an activeX backdoor into a windows machine. The only difference is Windows ain't free and neither is Symantec.
I run NetBSD and FreeBSD. When was the last time the NetBSD or FreeBSD servers were comprimised?
> But let's be real, here. Last year in the span of six months,
> Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.
We'll have to wait for an explanation of how it happened but my opinion is that Linux needs properly auditing and a security officer needs to be appointed who's job it is to check out stuff that goes into the tree.
The BSDs have this and they haven't had the security problems that Linux has had. Maybe it's due to the popularity of Linux but an audit/security officer wouldn't do any harm.
You have to expect that the admins of these boxes are far from clueless yet they still got broken in to. To me that indicates a problem with Linux development rather than use.
If an audit isn't done, then the cracks will keep on opening up & the reputation of Linux will be trashed.
The Machine stops.
That explains it!
KDE was trying to steal GNOME's super secret source code.;-)
His paper is a good example of how hard it is too change a open source projekt of today - since the compiler nowadays is separate from the rest of the code.
It's mucher harder today since one need to crack the security on soo many webbsites because of the distibuted development that is done in free and open software today on the Internet.
His example also shows that it only works if the same developer makes both the OS and the compiler.
Linux are not developed that way - however a large competetitor to Linux is....
Just saying it like it are.
Let's call up the media and analysts and tell them that Darl is attacking Linux projects again.
We would have the same proof he does of the attacks on SCO, right?
So, when is the FBI going to accounce their special task force to track down these dangerous hackers? After all, isn't that what they did when the Microsoft code was leaked? Something tells me this won't even make the FBI's radar, though...
"Save the whales, feed the hungry, free the mallocs" -- author unknown
I mean take them out back and hang the fuckers.
One less jerk on the face of the earth to deal with.
And no, im not kidding. Raise the stakes high enough and most wont risk it. And hunt down the few that do.
---- Booth was a patriot ----
We have to remember that most of the people working on Gnome and/or maintaining the servers are volunteers. That said, I have to tip my hat to these people for the very professional action they provided post the compromise. Taking down the compromised server, informing the community, and, most importantly, not releasing premature statements of blame or excuses (which is more than what I can say for a lot of professional companies).
It appears that somebody has decided that it's time to hack the hackers.
MacSlashThe most disturbing part is the message they left on the hacked GNOME main page:
You mean if they bundled? Someone is not an MSDN subscriber.
Troll? I'll bite...
People tend to forget that 'RedHat' and 'Debian' are much more than just an OS. They issue security reports for a webserver, several databases, ssh server, etc. Much more software is available through a Linux vendor. I doubt Microsoft even included it's other product lines in those security alerts their counting.
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
---to insert something e-vile to the downloads, no doubt methinks. I can't think of any other reason for the intrusion that makes any sense. (not counting casual maliciousness of course)
zogger
Just check the ftp server and its mirrors. All of the 2.6 components are out (nautilus included) with the version bumped up to 2.6.
You can get it and run it now...
MSDN subscription doesn't count since they come with restrictions on use, just like the "free" version of windows you may find on the net.
1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
... mental.sanity SHIELDS UP
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
They might steal the GNOME source code!!
That's not always true. Sure, people attack other people even though they have never met them before, but don't you think that if they were an enemy it would make them more of a target to a big attack like that?
Besides, I was joking. You shouldn't take shit like that so seriously and make little 6th-grade insults.
"Instant gratification takes too long." - Carrie Fisher
Gnome.org runs IIS? We all know that only Microsoft products are vulnerable....
Yup, KhackSite version 0.81 beta was just released yesterday with just one sample site in its .RC file. Not really a surprise, when you think about it. ;-)
First it's "Microsoft bundles too many things with Windows" and now it's "You can't compare Windows to a Linux distro because it only has 3 packages: kernel/GUI/browser"
Pick one.
Someone might actually be able to see the code to Gnome! Oh wait. Nevermind. :-)
Why would someone try to hack into an open source project?
Coder's Stone: The programming language quick ref for iPad
Free version of Windows? Or do you mean a pirated copy?
Actually, it is good news. Imagine the chaos if Gnome 2.6 was released, then a crack was detected. This way around Gnome 2.6 can be released at a later date with confidence.
Pirated copy, thus "free" instead of free.
1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
$699 license fee for "Linux" IP
From Netcraft:
e .org
http://uptime.netcraft.com/up/graph?site=www.gnom
Apache/1.3.27 (Unix) (Red-Hat/Linux) PHP/4.1.2 mod_perl/1.26 on Linux
Also the net block is not owned by Red Hat. Unlike redhat.com which sits on a difference cluster owned by Red Hat itself.
First it's "Microsoft bundles too many things with Windows" and now it's "You can't compare Windows to a Linux distro because it only has 3 packages: kernel/GUI/browser"
Pick one.
"Pick one" is exactly the problem with Windows. The system only gives you a choice of one kernel, one GUI, one Browser, one MediaPlayer, etc. A decent Linux distro will offer the user a variety of choices for all the above and much more.
Time is what keeps everything from happening all at once.
were when I did a cvs diff last !
Yep, yep.. That's exactly the problem.
They're using an unmaintained distro with more holes than a NJ highway.
gnome.org compromises YOU.
In any case, I'm not sure what that has to do with the previous posters comment, which was it's own brand of troll.
A typical linux distro comes with multiple office apllications, multiple web browsers, multiple mail clients, a mail, http, dns, sql, and samba server, irc clients, chat clients, multple desktop environments, tons of duplicated apps between gnome and kde. These distros come on multple CDs, I would expect this amount of patches for gigabytes of compiled programs. You choose what you put in, the distro has to patch what it choose to give you options for.
Looks like you were right...Sourceforge.net is locked down now, and will not allow logins! (I tried to submit..."rejected").
"Gentoo isn't stable enough, and it isn't meant to be."
Why does it not surprise me to see Gentoo-bashing from a Debian developer...
Don't you have something better to do, like delaying the release of Sarge again, or participating in an all-night license flamewar?
0 1 - just my two bits
Hi, I just noticed it is back online. I guess it wasn't anything too serious, hope it doesn't delay Gnome 2.6
I hear the web site is back up on a new domain.
Umm, this looks bad. Look at art.gnome.org. It is about pango.
At least one more than you, I would say.
I'm all for the right to bear arms, but something here worries me.
.sig and you'll know one reason why we have gun control.
Combine your post and your
It's not all an attempt to restrain "crime" (in the way we normally think of it), but also a fear of vigilantes (sometimes acting contrary to law).
If we want the right to bear arms, then other voters are going to need to understand that criminals are going to get weapons on the black market anyway, and those who legitimately own guns are going to abide by the law (my worry). I understand that you weren't literally serious, but it doesn't instill confidence in me about your owning a gun.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
word, motherfucker, word
I am not a developer, and am not bashing.
Leandro Guimarães Faria Corcete DUTRA
DA, DBA, SysAdmin, Data Modeller
GNU Project, Debian GNU/Lin
Too bad that was just a regular kernel hole, not one special to Debian's kernel. Any other distros can simply count themselves lucky the attackers didn't choose them.
Nope. Debian's kernels are special, because they are so far out of date.
Other Distributions use modern kernels. By contrast 2.4 only just made it into Debian-Stable prior to the release of 2.6 for Christ's sake.
"What was Linux like back in the mid 90's Daddy?"
"Install Debian son, find out for yourself."
I don't know any Linux distros that use anything but a Linux kernel. Actually, with Windows, you have a choice between the 9x kernel and the NT kernel.
It's also not like I can't install any alternatives on Windows. I use Winamp, Mozilla, Sysinternals's process explorer, and several cygwin tools instead of their MS alternatives. So what if they aren't listed by MS, they weren't very hard to find. Microsoft only provides one choice for each, but at least they are easy to use. When I first started using Linux, it wasn't helpful to know that there are 20 text editors I available; I don't know which to use, and many, like vim and emacs require a lengthy tutorial to do even simple things. No obvious choice as to which is the easiest to get started with.
Once I got X windows working, the window environs were easier, but I had to edit XF86's config file to get that far.
It must have been a KDE user...
Cheers,
RoadkillBunny
The other difference is your windows PC came full of adware and spyware and crippleware.
cat * >> sig
I knew they wouldn't finish on time
I don't know any Linux distros that use anything but a Linux kernel. Actually, with Windows, you have a choice between the 9x kernel and the NT kernel.
There is usually a choice between different kernel versions and patches for special uses, hardened, gaming, multimedia, not to mention kernels for different hardware platforms.
It's also not like I can't install any alternatives on Windows. I use Winamp, Mozilla, Sysinternals's process explorer, and several cygwin tools instead of their MS alternatives. So what if they aren't listed by MS, they weren't very hard to find.
Yes, you can use other tools, but can you choose not to install IE or MediaPlayer if you choose to use another app?
Microsoft only provides one choice for each, but at least they are easy to use. When I first started using Linux, it wasn't helpful to know that there are 20 text editors I available; I don't know which to use, and many, like vim and emacs require a lengthy tutorial to do even simple things. No obvious choice as to which is the easiest to get started with.
Compare apples to apples. You want an editor? If you chose KDE as your GUI KWrite is simple enough. From the command line nano suffices for an intuitive interface.
Anyway, the point is that the size difference between a decent Linux distro and Windows is due to Linux offering more choices. We can agree that finding documentation on how to use the software is usually better in Windows, but OSS apps have come a long way in that regards in the last couple of years.
Time is what keeps everything from happening all at once.
Fascinating. But what are the implications for the egg donor industry?
The fact that this would be a good time to TRY to touch the code does not mean that they had any success.
Hey, backing up creates Redundant data so in this case the moderation is surprisingly correct. Must have been a mistake.
There's a lot of that around here. Every time a program in a Linux distro has a problem we're reminded that it isn't really part of Linux. Every time someone says Linux doesn't have as many features, suddenly those flawed programs are reclassified as part of Linux again.
I guess I'm just complaining about the learning curve; there is so much out there to learn.
Man...don't you know anyone who uses Hotmail? It was down for hours a few fridays ago. A lot of net semi-literates (e.g. my girlfriend and her roommate) assumed their whole connection was down because hotmail and msn are the first two things their computers load.
I love that the first two comments on this said the complete opposite thing. Who's the troll?
It is quite a coincidence that software developers these days use hackers/crackers/magicians as scapegoats for project delays.
why not use unstable then? it has the 2.6 kernel.
other distributions also deprecate branches/versions that thousands use. debian continues to maintain everything.
With a fresh Red Hat 9 install, I had a terrible time even getting X windows to work, let alone KDE, requiring manual config editing. nano sounds like a good idea; I plan to check it out after I post this.
What you really want for commandline config file editing is Midnight Commander (mc). It's a file manager that you can use to get a good understanding of the directory structure and has a built-in editor. As for getting X up and running, try the generic vesa driver. Once you have gui running you can seek out info on the particulars on your card. Or you could stick to the command line and use lynx or links.
Time is what keeps everything from happening all at once.
sic the GIMP on 'em!!
free speach
Did you mean: free speech
Remember, the security of a system still depends greatly on the ability of the sysadmin.
The fact is, no one can say Microsoft is a nice, big, happy corporation that wants to play nice and fair with everyone in the world and be equal. It's just not true. Hence, it's hard to root for the big bad guy. I mean, unless you like that kind of thing.
It's much easier to be biased towards linux (for whatever reasons) but I think security isn't something you can say that linux is better than windows, or windows is better than linux. It really depends on the administrator.
There are other things that I personally like about linux (i.e. the fact that it's a community effort, (most of) the code is free, no tyranical and mystical empire ruling my destiny, etc.). I'm sure you don't need a laundry list...
Has sabotage been ruled out? There's nothing worse than your own people turning their backs on you. For all we know, someone who worked on the project might've been bribed into sabotaging the server.
A metric assload of posts talking about how all (800,000ish and counting) Slashdot readers are one person (the infamous Slashbot).
:)
:)
A bunch of "hey, Linux has problems, so stop saying anything negative about Microsoft" posts getting moderated to +5.
At least 100 people posting "Linux projects have been hacked many times in the past year, Microsoft none", while ignoring the complete and utter lack of Code Red, Slammer, Blaster, or any Warhol-type worm ever appearing for a *nix-based system, even though the majority of the internet is run off *nix. And no, the Morris worm doesn't count - Microsoft didn't even have a TCP/IP stack back in those days
A fair number of posts by > 500,000 UIDs, coincidentally almost always as a Microsoft apologist. Hmm, wonder who the new people are
Oh yeah, and (give or take) 20 different moderations to this post, varying between -1, Flamebait to +1, Insightful. I'd kill to see the UIDs of the moderators on something like this, because I'd bet a lot of money that I could guess the UID based on the moderation.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
HTTP/1.1 200 OK
Connection: keep-alive
Date: Wed, 24 Mar 2004 06:53:00 GMT
Server: Microsoft-IIS/6.0
Last-Modified: Wed, 24 Mar 2004 02:06:59 GMT
Accept-Ranges: bytes
Content-Length: 4100
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: ASPSESSIONIDRMSANDICAZASITTINGINATREEKISSING; path=/
Cache-control: private
Because you want to trust a news source whose site crashes with AODB errors when I decline to allow cookies.
I don't know any Linux distros that use anything but a Linux kernel. Actually, with Windows, you have a choice between the 9x kernel and the NT kernel.
;-)
Sorry to say it, but this was by FAR the most stupid comment I read in a while. WHY DO you think it's called LINUX ? *hint* the linux kernel *hint*
Now, if you want to use another Opensource kernel, try BSD. Both are UNIX clones, and both uses about the same portion of userspace applications, such as editors, X servers, desktop managers etc.
Now, about choice. Most current linux distributions come with either Linux 2.4 OR Linux 2.4. And that OR is non-exclusive, some distributions come with 2.4, but are already prepared to run 2.6 as well. Is you WinME NT-ready ?
Probable impossibilities are to be preferred to improbable possibilities.
Aristotele
Apparently /. requires a subject body - isn't that just lovely. Well, hopefully this will suffice, after all, my RSI wasn't really bad enough, so why not make it worse than it has to be?
* From: Owen Taylor
* To: gnome-hackers gnome org
* Cc: gnome-announce-list gnome org
* Subject: Update [was Re: Intrusion on www.gnome.org]
* Date: Wed, 24 Mar 2004 01:58:36 -0500
On Tue, 2004-03-23 at 13:52, Owen Taylor wrote:
> We've discovered evidence of an intrusion on the server
> hosting www.gnome.org and other gnome.org websites.
> At the present time, we think that the released gnome
> sources and the gnome source code repository are unaffected.
>
> We are investigating further and will provide updates
> as we know more. We hope to have the essential services
> hosted on the affected machine up and running again as soon
> as possible.
A quick status update on the situation:
* No additional damage has been discovered; at the current
time we are cautiously hopeful that the compromise was
limited in scope.
* ftp.gnome.org is back on now that we have additional
confidence in the integrity of the tarballs.
* We've now restored a number of services running on a
replacement machine
- Websites including www.gnome.org, and developer.gnome.org
are back up in limited service; dynamic content is still
off so some parts may be inaccessible.
- planet.gnome.org is again providing all your favorite
blogs and gossip.
- Bugzilla is in testing mode; we hope to restore general
access in the next day.
Thanks for your patience; we'll continue to provide updates
as we move back to fully operational status.
The GNOME sysadmin team
24 March 2004
Isn't it pretty obvious that they're pulling a Valve(tm) ? ;/
I think you may want to check out this link.
Every time you run "emerge", a Microsoft drone dies.
you have to take the space out of the link. slashcode adds it for some reason. without the space, it works fine.
The 'some reason' is the old page-widening trolls - they'd post a string of thousands of characters to screw up formatting.
Out of interest, what is the supposed difference between velocity and speed? Googling for the definition brought up "distance travelled per unit time" as first hit for both, and my dictionary says has the same translation for both.
Why? I think we are looking at completely different issues there. If you want to compare the security of two systems you need to do that with similar configurations. Whether it's legal to distribute software in a certain way is independent of it's quality.
As seen on gnome-announce
They didn't realize you can just download it from the public ftp.
Apparantly, some thick headed manager still can't concieve that code you can download for free can be valuable.
My Karma is so low that even my own postings are beyond my current threshold
Slammer. It brought down M$'s internal SQL servers because their admins had not installed the 6 month old security patch. Thank you.
Yes, you can use other tools, but can you choose not to install IE or MediaPlayer if you choose to use another app?
So what? If the associations are setup to launch your app of choice, who cares? If it ain't run, it may as well not be there.
Which is more painful? Going to work or gouging your eye out with a spoon? Find out!
http://www.workorspoon.com
Yay!
Now your an obsessive moron! (find the missing ' please?)
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
i guess they were running debian. so, it was so difficult to hack their system(s). too many gnu
Now your an obsessive moron! (find the missing ' please?)
There's also a missing "e": it should be "you're". Oh, and by the way, your website is riddled with grammatical errors. So I'm led to believe that your mistakes aren't even deliberate: you really are a retard.
Tubal-Cain smokes the white owl.
*rofl*
:-)
Dude, you're a hoot. Some of the mistakes you've been finding *are* deliberate, some aren't. Yes, the missing 'e' was deliberate. But what the fuck do I care? I'm sorta curious as to why the fuck you care. But in the end, its much more fun to annoy you. Whether it's on purpose or its not.
Insult me all you like fucknuts! At least I'm not anal enough to go search out some guys web-site and check it for grammar... Christ, you need a woman. Bad. Seriously. Even if you have to pay dude.
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
YHBT. YHL. HAND.
Wow, your really serious to, arent you.
But looking at your rather bland posting history, I suppose this demonstration of stupidity and ironisy shouldnt be surprising.
We know of at least one company that doesn't do much "cleaning up" after such an incedent: the electronic voting company DiBold.
In reality you can trust nothing on a compromised system. You need to install it from scratch and only copy data files over that you can verify (through checksums, signatures, etc.) have not been modified. You can not do this checking on the compromized system because the programs to do the checking may have been modified, or even the kernel.